MITRE ATT&CKgroup

G0012 Darkhotel

Published 2017-05-31 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
DUBNIUM, Zigzag Hail
Version
3.0
Created
2017-05-31

Description

Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.

Related

Uses · MITRE ATT&CK (24)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1497.001 System Checks sub-technique
  • T1497.002 User Activity Based Checks sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1056.001 Keylogging sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1553.002 Code Signing sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1497 Virtualization/Sandbox Evasion technique
  • T1189 Drive-by Compromise technique
  • T1203 Exploitation for Client Execution technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1016 System Network Configuration Discovery technique
  • T1057 Process Discovery technique
  • T1080 Taint Shared Content technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1091 Replication Through Removable Media technique
  • T1105 Ingress Tool Transfer technique
  • T1124 System Time Discovery technique

References