Threat Investigation
Request a demo
State-sponsored

DarkHotel

DarkHotel is classified as state-sponsored.

Malware families
10
Suspected state sponsor
South Korea
Also known as
16

Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crews most unusual characteristic is that for several years the Darkhotel APT has maintained a capability to use hotel networks to follow and hit selected targets as they travel around the world.'

The group is suspected of operating with the support of South Korea.

The group is associated with 10 malware families.

Also known as: DUBNIUM, Fallout Team, Karba, Luder, Nemim, Nemin, Tapaoux, Pioneer, Shadow Crane, APT-C-06, SIG25, TUNGSTEN BRIDGE, T-APT-02, G0012, ATK52, Zigzag Hail

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

DarkHotel · Threat actors · Dark Radar