{
  "family": "darkhotel",
  "sample_count": 1,
  "category": "backdoor",
  "description": "Backdoor:Win32/Darkhotel is an advanced, highly surgical cyber-espionage threat campaign and modular backdoor active since at least 2007, first publicly revealed by Kaspersky Lab researchers in November 2014. The group specializes in targeted intrusions against high-ranking corporate executives, CEOs, defense contractors, top venture capitalists, and government diplomats staying at luxury hotels across Asia and Europe. Darkhotel infiltrates luxury hotel Wi-Fi networks and guest authentication portals, tracking target guest reservations and serving deceptive fake software updates (masquerading as Google Toolbar, Adobe Flash Player, or Windows Messenger) signed with stolen, legitimate commercial code-signing digital certificates (including compromised 512-bit and 1024-bit MD5 certificates). Once installed on executive laptops, the Darkhotel backdoor deploys modular keyloggers, credential harvesters, and selective document exfiltration components, subsequently deleting all staging files from hotel network infrastructure to evade detection. Darkhotel also executes targeted spear-phishing campaigns delivering zero-day exploits (including CVE-2010-0188 and CVE-2014-0322) against high-profile political and economic targets.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Darkhotel",
    "APT.Darkhotel",
    "Trojan.Darkhotel",
    "Tapaoux",
    "Fallout",
    "Karba"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Darkhotel APT campaign?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Darkhotel is an advanced persistent threat (APT) group that compromises luxury hotel Wi-Fi networks to spy on traveling corporate executives, diplomats, and defense contractors."
      }
    },
    {
      "@type": "Question",
      "name": "How does Darkhotel compromise hotel guests?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Darkhotel compromises hotel Wi-Fi portals, tracking executive arrivals to push fake software updates signed with stolen code-signing certificates."
      }
    },
    {
      "@type": "Question",
      "name": "What digital certificate techniques were used by Darkhotel?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Darkhotel was notable for using legitimate stolen certificates and pioneering mathematical MD5 collision techniques to forge trusted code-signing credentials."
      }
    },
    {
      "@type": "Question",
      "name": "What data is targeted by Darkhotel implants?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Darkhotel harvests executive login credentials, keystrokes, confidential corporate negotiations, intellectual property, and encrypted communications."
      }
    },
    {
      "@type": "Question",
      "name": "How can traveling business executives defend against Darkhotel?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenses include using secure cellular hotspots instead of public hotel Wi-Fi, enforcing full-tunnel enterprise VPNs, and rejecting software update prompts on untrusted networks."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1195.002",
    "T1566.001",
    "T1553.002",
    "T1056.001",
    "T1005",
    "T1071.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1195.002",
      "name": "Compromise Software Supply Chain",
      "tactic": "initial-access"
    },
    {
      "id": "T1566.001",
      "name": "Spearphishing Attachment",
      "tactic": "initial-access"
    },
    {
      "id": "T1553.002",
      "name": "Code Signing",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "collection"
    },
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactic": "collection"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2007,
  "lineage": {
    "derived_from": [],
    "variants": [
      "darkhotel tapaoux v1",
      "karba downloader",
      "dubnium / fallout module"
    ]
  },
  "attribution": [
    {
      "actor": "East Asian State-Sponsored APT Syndicate",
      "confidence": "high"
    },
    {
      "actor": "Darkhotel Threat Group",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2010-0188",
    "CVE-2014-0322",
    "CVE-2017-0199"
  ],
  "c2_profile": {
    "protocols": [
      "HTTPS",
      "HTTP"
    ],
    "ports": [
      443,
      80
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "2f82ba1851b415a782bca8ca2107455cf6433ae6506fbc3b53f0fa752243d467",
      "7c58ab7df0c8f5379b1836171a4f00843657b8599426f8d0ab7cfeb702221b6c"
    ],
    "delivery": [
      "hotel_wifi_portal_injection",
      "spearphishing_attachment"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Scheduled Tasks"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Lab GReAT: The Darkhotel APT A Story of Unusual Hospitality",
      "url": "https://securelist.com/the-darkhotel-apt/66779/"
    },
    {
      "name": "Trend Micro Security Intelligence: Darkhotel Espionage Operations",
      "url": "https://www.trendmicro.com/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2014-0322",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0322"
    }
  ],
  "containment_steps": [
    "Immediately disconnect corporate laptops from hotel Wi-Fi and establish isolated cellular network connectivity.",
    "Perform memory and forensic analysis on endpoints that accepted software updates during travel.",
    "Verify all digital code-signing certificates on newly executed executables against enterprise trust stores.",
    "Enforce mandatory full-tunnel corporate VPN policies with always-on kill switches for all remote endpoints."
  ],
  "what_to_avoid": [
    "Never accept or execute software update prompts delivered over hotel Wi-Fi portal pages.",
    "Avoid connecting sensitive corporate laptops to public or hospitality Wi-Fi networks without VPN encryption.",
    "Do not trust executable software solely based on code signatures if certificate validity is dubious."
  ],
  "target_industries": [
    "executive_leadership",
    "defense",
    "aerospace",
    "venture_capital",
    "government"
  ],
  "motivation": "Corporate & Diplomatic Cyber Espionage",
  "threat_actors": [
    "Darkhotel APT Group"
  ],
  "target_geographies": [
    "JP",
    "KR",
    "US",
    "CN",
    "RU",
    "DE"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "defense-evasion",
    "credential-access",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows",
    "x86",
    "x64"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}