modified: 2024-01-08T20:27:56.707Z
name: Darkhotel
description: [Darkhotel](https://attack.mitre.org/groups/G0012) is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. [Darkhotel](https://attack.mitre.org/groups/G0012) has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.(Citation: Kaspersky Darkhotel)(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft Digital Defense FY20 Sept 2020)
aliases: Darkhotel
DUBNIUM
Zigzag Hail
x_mitre_deprecated: no
x_mitre_version: 3.0
x_mitre_contributors: Harry Kim, CODEMIZE
type: intrusion-set
spec_version: 2.1
id: intrusion-set--9e729a7e-0dd6-4097-95bf-db8d64911383
created: 2017-05-31T21:31:50.624Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0012
external_id: G0012
source_name: Darkhotel
description: (Citation: Kaspersky Darkhotel)
source_name: DUBNIUM
description: (Citation: Microsoft Digital Defense FY20 Sept 2020)(Citation: Microsoft DUBNIUM June 2016)(Citation: Microsoft DUBNIUM Flash June 2016)(Citation: Microsoft DUBNIUM July 2016)
source_name: Zigzag Hail
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Securelist Darkhotel Aug 2015
description: Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.
url: https://securelist.com/darkhotels-attacks-in-2015/71713/
source_name: Kaspersky Darkhotel
description: Kaspersky Lab's Global Research and Analysis Team. (2014, November). The Darkhotel APT A Story of Unusual Hospitality. Retrieved November 12, 2014.
url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf
source_name: Microsoft Digital Defense FY20 Sept 2020
description: Microsoft . (2020, September 29). Microsoft Digital Defense Report FY20. Retrieved April 21, 2021.
url: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWxPuf
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Microsoft DUBNIUM July 2016
description: Microsoft. (2016, July 14). Reverse engineering DUBNIUM – Stage 2 payload analysis . Retrieved March 31, 2021.
url: https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/
source_name: Microsoft DUBNIUM Flash June 2016
description: Microsoft. (2016, June 20). Reverse-engineering DUBNIUM’s Flash-targeting exploit. Retrieved March 31, 2021.
url: https://www.microsoft.com/security/blog/2016/06/20/reverse-engineering-dubniums-flash-targeting-exploit/
source_name: Microsoft DUBNIUM June 2016
description: Microsoft. (2016, June 9). Reverse-engineering DUBNIUM. Retrieved March 31, 2021.
url: https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5