Darkhotel - G0012

Created: 2017-05-31T21:31:50.624Z

Modified: 2022-10-19T22:07:30.243Z

Contributors: Harry, CODEMIZE

Aliases

Darkhotel,DUBNIUM

Description

Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.(Citation: Kaspersky Darkhotel)(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft Digital Defense FY20 Sept 2020)

Techniques Used

Darkhotel has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system.(Citation: Lastline DarkHotel Just In Time Decryption Nov 2015)|
|mitre-attack|enterprise-attack|Windows,Network|T1124|System Time Discovery|

Darkhotel malware can obtain system time from a compromised host.(Citation: Lastline DarkHotel Just In Time Decryption Nov 2015)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1497|Virtualization/Sandbox Evasion|

Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.(Citation: Lastline DarkHotel Just In Time Decryption Nov 2015)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Darkhotel has used malware that is disguised as a Secure Shell (SSH) tool.(Citation: Microsoft DUBNIUM June 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1497.001|System Checks|

Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with