Darkhotel has been known to establish persistence by adding programs to the Run Registry key.(Citation: Kaspersky Darkhotel)|
|mitre-attack|enterprise-attack|Windows|T1091|Replication Through Removable Media|

Darkhotel's selective infector modifies executables stored on removable media as a method of spreading across computers.(Citation: Kaspersky Darkhotel)|
|mitre-attack|enterprise-attack|Windows,Office 365,SaaS,Linux,macOS|T1080|Taint Shared Content|

Darkhotel used a virus that propagates by infecting executables stored on shared drives.(Citation: Kaspersky Darkhotel)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen.

Darkhotel has also stolen certificates and signed backdoors and downloaders with them.(Citation: Kaspersky Darkhotel)(Citation: Securelist Darkhotel Aug 2015)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Darkhotel has used a keylogger.(Citation: Kaspersky Darkhotel)|