Darkhotel

Executive Summary

Darkhotel, a suspected South Korean threat group, conducts cyberespionage targeting primarily East Asian countries, focusing on government sectors and traveling executives through hotel networks. Known for long-term operations since at least 2004, they employ phishing, exploitCVE-2015-8651, and peer-to-peer infections to gather intelligence.

Goals & Targeting

Darkhotel's primary motivation is espionage, targeting government sectors to gather intelligence. Their focus on East Asian countries suggests a strategic interest in geopolitical intelligence. Typical victims include traveling executives, diplomats, and other high-profile individuals likely to have access to sensitive information while in transit or at hotels.

Darkhotel is a cyberespionage group believed to be based in South Korea, active since 2004. They primarily target East Asian countries including Russia, China, Taiwan, South Korea, North Korea, and Japan. The group gained notoriety by compromising hotel networks to target traveling executives and other high-value individuals. Darkhotel uses multiple attack vectors, including spearphishing campaigns, peer-to-peer file sharing infections, and exploiting CVE-2015-8651. Their operations often involve sophisticated techniques such as keylogging, code signing, and encryption to avoid detection. They have been linked to several campaigns like 'Wizard Opium' and 'Higaisa', which demonstrate their capability to persistently monitor targets for sensitive information.

Key Capabilities

• Spearphishing campaigns
• Exploitation of CVE-2015-8651
• Peer-to-peer file sharing infections
• Keylogging malware
• Code signing techniques
• Malicious file creation and distribution

MITRE ATT&CK Tactics

ATT&CK Techniques

Campaigns & Victims

Darkhotel's campaigns demonstrate long-term persistence and targeting precision. Notable operations include their hotel network compromises for espionage, spearphishing efforts, and use of malicious files. The group has been observed since at least 2015, with activity continuing in recent years as noted by Microsoft in September 2020. Their victims include both governmental entities and private sector executives traveling through targeted regions.

IOC Patterns

• Spearphishing emails targeting travelers
• Hashes of malicious files (MD5)
• Compromise via hotel or public Wi-Fi networks
• Use of domains like 'all-microsoft-control.com' for C2
• Encrypted/encoded communication channels

Recommended Actions

• Monitor network traffic in hotels and high-risk travel locations for suspicious activity.
• Educate employees on phishing tactics, especially when traveling to targeted regions.
• Implement endpoint detection solutions to identify malicious file patterns associated with Darkhotel.
• Conduct regular security audits of external devices used by executives.
• Use sandboxes to analyze unknown files before allowing execution.

Suggested Tags