Darkhotel
Threat actorAttributed to South Korea by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- DarkhotelOur name
- DUBNIUMMicrosoft
- Zigzag HailMicrosoft
Targets
Sectors: Hospitality
Regions: East Asia, South Korea
Source: MITRE ATT&CKKnown techniques
- T1016System Network Configuration Discovery
- T1027.013Encrypted/Encoded File
- T1036.005Match Legitimate Resource Name or Location
- T1056.001Keylogging
- T1057Process Discovery
- T1059.003Windows Command Shell
- T1080Taint Shared Content
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1091Replication Through Removable Media
- T1105Ingress Tool Transfer
- T1124System Time Discovery
- T1140Deobfuscate/Decode Files or Information
- T1189Drive-by Compromise
- T1203Exploitation for Client Execution
- T1204.002Malicious File
- T1497Virtualization/Sandbox Evasion
- T1497.001System Checks
- T1497.002User Activity Based Checks
- T1518.001Security Software Discovery
- T1547.001Registry Run Keys / Startup Folder
- T1553.002Code Signing
- T1566.001Spearphishing Attachment
- T1573.001Symmetric Cryptography
Recent news
No stories yet.