{"id":462,"count":0,"description":"
\n
\n Year Established<\/span>\n
2007<\/div>\n <\/div>\n
\n Attribution<\/span>\n
South Korea (Suspected)<\/div>\n <\/div>\n
\n Motivation<\/span>\n
Espionage, Corporate Intelligence<\/div>\n <\/div>\n
\n Modus Operandi (MO)<\/span>\n
Hotel Wi-Fi attacks, spear-phishing senior executives, zero-day exploitation<\/div>\n <\/div>\n
\n Primary Aliases<\/span>\n
Dubnium, TUNGSTEN BRIDGE, Karba, SIG25<\/div>\n <\/div>\n<\/div>\n

DarkHotel is a sophisticated threat actor group attributed with moderate confidence to South Korean intelligence services, distinguished by its highly creative and patient targeting methodology: compromising the Wi-Fi networks of luxury hotels and business hotels across Asia to deliver malware to high-value executive guests during their stays. This \"hotel Wi-Fi attack\" technique gave the group its name and remains one of the most distinctive attack vectors attributed to any nation-state APT group.<\/p>\n

The group's operational approach demonstrated exceptional intelligence preparation: DarkHotel operators would identify specific target executives planning to stay at particular hotels , via travel booking records, corporate itineraries, or open-source intelligence , and pre-position malware on those hotels' networks to intercept the specific target's device when they connected to the in-room Wi-Fi. This targeted precision, combined with the use of software update spoofing to trick executives into installing malicious \"updates,\" demonstrated a level of operational sophistication far beyond typical cybercriminal activity.<\/p>\n

Beyond the hotel Wi-Fi vector, DarkHotel conducts conventional spear-phishing campaigns against senior executives, board members, and C-suite officials at multinational corporations with operations in Asia. The group has exploited multiple Adobe Flash, Internet Explorer, and Windows zero-day vulnerabilities , a significant resource investment indicating state-level capability and motivation. Their targets span pharmaceutical, automotive, electronics, and defence manufacturing sectors.<\/p>\n

DarkHotel has been active for nearly two decades, demonstrating exceptional operational longevity and adaptation. Their continued investment in zero-day exploitation and sophisticated targeting methodologies , including more recent campaigns using spear-phishing with COVID-19 pandemic lures against biomedical and pharmaceutical researchers , confirms an ongoing, well-resourced intelligence collection mandate showing no signs of diminishment.<\/p>\n\n

Threat Mitigation and Strategic Hardening:<\/strong> Network defense against campaigns linked to DarkHotel<\/strong> requires continuous threat surface management, dark web monitoring for stolen employee credentials, and automated telemetry correlation. Organizations should reference our Cyber Risk Checker<\/a> and report critical indicators via Secure Drop<\/a>.<\/p>","link":"https:\/\/cyberasia.io\/actor\/darkhotel\/","name":"DarkHotel","slug":"darkhotel","taxonomy":"threat_actor","parent":0,"meta":[],"_links":{"self":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors\/462","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors"}],"about":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/taxonomies\/threat_actor"}],"wp:post_type":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts?threat_actors=462"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}