GINC Technology
GINC-APT-0044 · State

Darkhotel

Also APT-C-60, DUBNIUM, Zigzag Hail, APT-C-06, APT-Q-12, ATK52 and 22 other names.

Category
State · Attributed to a state or working for one.
Origin
South Korea(high confidence)
Sponsor
Korea (Republic of)
Motivation
Espionage; Information theft and espionage
Seen
2014–2026
Status
Active
ATT&CK
G0012 · 24 techniques
Sources
11 sources carry it
Identifier
GINC-APT-0044 · darkhotel

What it is

Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

CrowdStrike
Shadow Crane, Tardigrade Spider
Microsoft
Zigzag Hail
MITRE ATT&CK
G0012
NSA leak
SIG25
QiAnXin
APT-Q-12
Qihoo 360
APT-C-60, APT-C-06
Secureworks
TUNGSTEN BRIDGE
Thales
ATK52
Other names
DUBNIUM, Dark Hotel, Darkhotel - APT-C-06, Dubnium (Microsoft), Egobot, Fallout Team, Karba, Luder, Nemim, Nemin, PALADIN, Pioneer, Purple Pygmy, SIG25 (NSA), T-APT-02, Tapaoux, TEMPLAR, TieOnJoe

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Chinese and Russian sources

Targets

Countries
China, Japan, Russia, South Korea, Taiwan
Sectors
Private sector

Tools

The tools and malware families the sources tie to it.

  • Asruex
  • CVE-2010-2883
  • CVE-2012-0158
  • CVE-2015-8651
  • CVE-2016-4171 and CVE-2018-817
  • Higaisa
  • Inexsmar
  • Win32.Karba
  • Win32.Pioneer

Sources