Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crews most unusual characteristic is that for several years the Darkhotel APT has maintained a capability to use hotel networks to follow and hit selected targets as they travel around the world.'
Also known as
DUBNIUM, Fallout Team, Karba, Luder, Nemim, Nemin, Tapaoux, Pioneer, Shadow Crane, APT-C-06, SIG25, TUNGSTEN BRIDGE, T-APT-02, G0012, ATK52, Zigzag Hail, Dark Hotel, TEMPLAR, TieOnJoe, Purple Pygmy, Egobot, PALADIN, APT-C-60.
References
- securelist.com
- blogs.technet.microsoft.com
- securelist.com
- securelist.com
- web.archive.org
- labs.bitdefender.com
- cfr.org
- securityweek.com
- attack.mitre.org
- secureworks.com
- antiy.cn
Actor metadata imported from Malpedia (Fraunhofer FKIE).