DarkHotel
DUBNIUMFallout TeamKarbaLuderNemimNeminTapaouxPioneerShadow CraneAPT-C-06SIG25TUNGSTEN BRIDGET-APT-02G0012ATK52Zigzag Hail
Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crews most unusual characteristic is that for… Source: MISP
Attributed country: KR according to MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 10 Nov 2026 · last seen on 10 Nov 2026
News
- Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes NextSecurityWeek · 10 Nov 2026
MITRE ATT&CK techniques
Initial Access
T1091Replication Through Removable MediaT1189Drive-by Compromise 3 Sigma rulesT1566.001Spearphishing Attachment 21 Sigma rules
Execution
T1059.003Windows Command Shell 40 Sigma rulesT1203Exploitation for Client Execution 31 Sigma rulesT1204.002Malicious File 32 Sigma rules
Persistence
Credential Access
Discovery
T1016System Network Configuration Discovery 4 Sigma rulesT1057Process Discovery 3 Sigma rulesT1082System Information Discovery 18 Sigma rulesT1083File and Directory Discovery 17 Sigma rulesT1124System Time Discovery 1 Sigma rulesT1497Virtualization/Sandbox Evasion 3 Sigma rulesT1497.001System Checks 3 Sigma rulesT1497.002User Activity Based ChecksT1518.001Security Software Discovery 5 Sigma rules
Lateral Movement
Command and Control
Stealth
T1027.013Encrypted/Encoded FileT1036.005Match Legitimate Resource Name or Location 20 Sigma rulesT1140Deobfuscate/Decode Files or Information 17 Sigma rules
Defense impairment
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗