Threat Actor: Darkhotel APT Group
Darkhotel APT Group is classified as an advanced Nation-State APT originating primarily from East Asia. Driven by operational objectives spanning high-value executive espionage, c-suite wiretapping & zero-day weaponization, this threat entity has maintained an active footprint from 2007 - Present. In enterprise telemetry and malware repository classification, Darkhotel APT Group has been corroborated across 1 distinct malware families with over 1 validated sample hashes.
Operational Threat Profile & Targeting
| Known Aliases | Tapaoux, Karba, Fallout Team, Shadow-Crane |
|---|---|
| Targeted Sectors | Luxury Hotel Wi-Fi Networks, Traveling CEOs & Defense Executives, Venture Capital, Semiconductor Firms |
| Primary Motivations | High-Value Executive Espionage, C-Suite Wiretapping & Zero-Day Weaponization |
| Dominant Payload Categories | Backdoor |
| MITRE ATT&CK Reference | https://attack.mitre.org/groups/G0012/ ↗ |
Primary Observed MITRE ATT&CK Tradecraft
The following offensive techniques have been empirically verified across implants and campaign tooling weaponized by Darkhotel APT Group:
Exploited Vulnerabilities (CVEs)
Telemetry confirms Darkhotel APT Group has actively weaponized the following Common Vulnerabilities and Exposures in enterprise intrusions:
- CVE-2010-0188 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2014-0322 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-0199 — Technical Dossier & Exploitation Analysis (NVD ↗)
Attributed Catalog Malware Families (1 Families)
The following malware implants in the SystemHelpDesk catalog have been verified in operational campaigns attributed to Darkhotel APT Group:
SOC Hardening & Defensive Containment
Defending enterprise perimeters against campaigns staged by Darkhotel APT Group requires defense-in-depth posture enforcement:
- Egress Filtering & C2 Interception: Enforce strict egress inspection and block communication to unclassified external IP blocks, fast-flux proxy relays, and dynamic DNS providers.
- Credential Isolation & Privileged Access Management: Enforce FIDO2 hardware MFA across all administrative and VPN entry points to prevent session token hijacking and password reuse.
- Attack Surface Reduction & Patch Velocity: Prioritize remediation of public-facing edge network appliances (VPN concentrators, web servers, file transfer appliances).