Darkhotel
- ID
- G0012
- Associated names
- DUBNIUM, Zigzag Hail
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.[1][2][3]
Techniques used (24)
- T1016 System Network Configuration Discovery
- T1027.013 Encrypted/Encoded File
- T1036.005 Match Legitimate Resource Name or Location
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1080 Taint Shared Content
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1091 Replication Through Removable Media
- T1105 Ingress Tool Transfer
- T1124 System Time Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1497 Virtualization/Sandbox Evasion
- T1497.001 System Checks
- T1497.002 User Activity Based Checks
- T1518.001 Security Software Discovery
- T1547.001 Registry Run Keys / Startup Folder
- T1553.002 Code Signing
- T1566.001 Spearphishing Attachment
- T1573.001 Symmetric Cryptography