Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · DarkHotel · Nation-state · assessed origin South Korea · misp-galaxy + mitre-attack · refreshed 2026-10-06

DarkHotel

  • DUBNIUM
  • Fallout Team
  • Karba
  • Luder
  • Nemim
  • Nemin
  • Tapaoux
  • Pioneer

state sponsor · Korea (Republic of)MITRE G0012 ↗

DarkHotel — ATT&CK roseDA

attack rose · 24 techniques across 9 tactics

What changed

ledger · newest first
  1. —todaynew CVE4 new CVEs: CVE-2014-0497, CVE-2015-8651, CVE-2018-8174, CVE-2019-1367

Analyst brief

misp-galaxy + mitre-attack

Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crews most unusual characteristic is that for several years the Darkhotel APT has maintained a capability to use hotel networks to follow and hit selected targets as they travel around the world.'

Observed targets (as stated by the sources)

5 countries · 1 sectors
JapanRussiaTaiwanSouth KoreaChinaAssessed origin: South Korea

assessed origin · South Koreaobserved targets · 5

countries · 5

  • Japan
  • Russia
  • Taiwan
  • South Korea
  • China

sectors · 1

  • Private sector

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

24 techniques · 9 of 15 tactics

  1. Initial access

    2 techniques

  2. Execution

    3 techniques

  3. Persistence

    1 technique

  4. Stealth

    6 techniques

  5. Defense impairment

    1 technique

  6. Discovery

    6 techniques

  7. Lateral movement

    2 techniques

  8. Collection

    1 technique

  9. Command and control

    2 techniques

select a technique

CVEs cited sources tie to DarkHotel

none on KEV
  1. CVE-2018-81742026-10-17
    1. “May 2018: a new wave of targeted attacks abusing CVE-2018-8174 (this exploit has been associated with the DarkHotel APT group, as described on Securelist )”

      attributed by a report · source: securelist.com ↗ · 2026-10-17

  2. CVE-2015-86512026-10-17
    1. “Darkhotel has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2019-13672026-10-17
    1. “At the end of January, we stumbled upon a malicious script exploiting an Internet Explorer vulnerability, CVE-2019-1367. After closely examining the payload and finding connections with previous activity, we concluded that DarkHotel was behind this campaign, probably in progress since 2018.”

      cited as exploiting · source: securelist.com ↗ · 2026-10-17

  4. CVE-2014-04972026-10-17
    1. “it looks as though the “tisone360.com” site was delivering a Flash CVE-2014-0497 exploit in April. We reported the related vulnerability to Adobe in January 2014, when it was being used by the Darkhotel APT.”

      cited as exploiting · source: securelist.com ↗ · 2026-10-17

    2. “it looks as though the “tisone360.com” site was delivering a Flash CVE-2014-0497 exploit in April. We reported the related vulnerability to Adobe in January 2014, when it was being used by the Darkhotel APT.”

      cited as exploiting · source: securelist.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2017Inexsmar: An unusual DarkHotel campaigBitdefender ↗
  2. 2016Reverse-engineering DUBNIUMMicrosoft ↗
  3. 2016Reverse-engineering DUBNIUM's Flash-targeting exploitMicrosoft ↗
  4. 2015Darkhotel's attacks in 2015 Kaspersky ↗
  5. 2014Darkhotel Indicators Of CompromiseKaspersky ↗
  6. 2014The Darkhotel Apt A Story Of Unusual Hospitality v1.0Kaspersky ↗

Take it with you

keyless · no signup

References

18 sources
  1. 1.securelist.com/blog/research/71713/darkhotels-attacks-in-2015
  2. 2.blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-dubnium-2
  3. 3.securelist.com/blog/research/66779/the-darkhotel-apt
  4. 4.securelist.com/the-darkhotel-apt/66779
  5. 5.web.archive.org/web/20160104165148/http://drops.wooyun.org/tips/11726
  6. 6.labs.bitdefender.com/wp-content/uploads/downloads/inexsmar-an-unusual-darkh…
  7. 7.cfr.org/interactive/cyber-operations/darkhotel
  8. 8.securityweek.com/darkhotel-apt-uses-new-methods-target-politicians
  9. 9.attack.mitre.org/groups/G0012
  10. 10.secureworks.com/research/threat-profiles/tungsten-bridge
  11. +8 more in the JSON record

Track DarkHotel on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.