Overview 326 indicators
Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.
| domain | 314 | G0012-domain.txt |
| url_path | 7 | G0012.json |
| ipv4 | 3 | G0012.json |
| url | 2 | G0012.json |
Techniques 24 ATT&CK
Open in ATT&CK Navigator → or download the layer (24 techniques, layer 4.5)
- T1016 System Network Configuration Discovery
- T1027.013 Encrypted/Encoded File
- T1036.005 Match Legitimate Resource Name or Location
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1080 Taint Shared Content
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1091 Replication Through Removable Media
- T1105 Ingress Tool Transfer
- T1124 System Time Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1497 Virtualization/Sandbox Evasion
- T1497.001 System Checks
- T1497.002 User Activity Based Checks
- T1518.001 Security Software Discovery
- T1547.001 Registry Run Keys / Startup Folder
- T1553.002 Code Signing
- T1566.001 Spearphishing Attachment
- T1573.001 Symmetric Cryptography
Principal sources 23 reports
Ranked by how many of this actor's indicators each report brought in.
- 282securelist.com/blog/research/66779/the-darkhotel-apt
- 13twitter.com/ximo2006/status/1142983148893954048
- 13s.tencent.com/research/report/741.html (Chinese)
- 7insight-jp.nttsecurity.com/post/102ho8o/operation-restylink (Japan…
- 7otx.alienvault.com/pulse/627b9aa3b3842d989f57bfe6
- 7blog.nsfocus.net/darkhotel-3-0908
- 7virustotal.com/gui/file/6048f17c1271c0f946225ec6a3d1f4…
- 6mp.weixin.qq.com/s/nyxZFXgrtm2-tBiV3-wiMg
Timeline 326 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
300 shown
Showing the 300 most recent of 326. Complete: G0012.json.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
securelist.com/blog/research/66779/the-darkhotel-apt
alexa97.com -
insight-jp.nttsecurity.com/post/102ho8o/operation-restylink (Japan… · otx.alienvault.com/pulse/627b9aa3b3842d989f57bfe6
differentfor.com disknxt.com mbusabc.com officehoster.com spffusa.org sseekk.xyz youmiuri.com -
virustotal.com/gui/file/da0c905ab56f598c50573495085657…
myboxofficebox.com -
trellix.com/en-us/about/newsroom/stories/threat-lab… · virustotal.com/gui/file/f699f5c8ea766afe9cffcff198d135…
fsm-gov.com -
blog.nsfocus.net/darkhotel-3-0908 · virustotal.com/gui/file/6048f17c1271c0f946225ec6a3d1f4…
domain bigfile-download.net url_path /html/docu.php url_path /maro7/article//000C29014444/article_service.html url_path /maro7/live1.php -
mp.weixin.qq.com/s/nyxZFXgrtm2-tBiV3-wiMg
domain account163-mail.com domain apple-onlineservice.com domain onlineservice.bounceme.net url http://134.119.220.118 url http://185.198.56.191 url_path /recommend/ascfree.php -
securelist.com/ie-and-windows-zero-day-operation-power… · otx.alienvault.com/pulse/5f34088f58d80664ae9fbd1c
static-cdn1.com -
twitter.com/blackorbird/status/1263843202311663616 · antiy.cn/research/notice&report/research_report/…
email-126.net find-image.com service-security-manager.com win-api-essentials.com -
twitter.com/blackorbird/status/1245597745403969544
tax-lab.net -
twitter.com/blackorbird/status/1245597745403969544
cnnmedia.servepics.com -
securelist.com/chrome-0-day-exploit-cve-2019-13720-use… · otx.alienvault.com/pulse/5dbc5ca2e4310e29af9612e3
behindcorona.com -
twitter.com/ximo2006/status/1142983148893954048 · s.tencent.com/research/report/741.html (Chinese)
domain 100100011100.com domain 779999977.com domain banilasky.com domain game-service.org domain office-update-checker.com domain offices-support.com domain star--co.net ipv4 193.29.187.178:51217 ipv4 193.29.187.178:51218 ipv4 91.235.116.147:9782 url_path /584e3411-14a7-41f4-ba1d-e203609b0471/6126.php url_path /7cdeb7fe-6efd-4459-be2f-1eb0e0088a60/21147.php url_path /banila/config.php -
blogs.jpcert.or.jp/ja/2019/05/darkhotel_lnk.html (Japanese) · otx.alienvault.com/pulse/5cee9ffe72473a4c259773b7
pwsmbx.com reuqest-userauth.com vgmtx.com -
ti.360.net/blog/articles/analyzing-attack-of-cve-2… · researchcenter.paloaltonetworks.com/2018/09/unit42-traps-prevents-wild-vbsc…
windows-updater.net -
securelist.com/blog/research/66779/the-darkhotel-apt
appfreetools.com digitalimagestudy.com -
securelist.com/blog/research/66779/the-darkhotel-apt
163pics.net 163services.com 42world.net 88dafa.biz academyhouse.us ackr.myvnc.com acrobatup.com adobearm.com adobeplugs.net adoberegister.flashserv.net adobeupdates.com albasrostga.com alphacranes.com alphastros.com amanity50.biz anti-wars.org applyinfo.org auto2115.icr38.net auto2116.phpnet.us auto24col.info autobaba.net84.net autoban.phpnet.us autobicy.yaahosting.info autobicycle.20x.cc autobicycle.freehostking.com autobicyyyyyy.50gigs.net autoblank.oni.cc autobrown.gofreeserve.com autocash.000php.com autocashhh.hostmefree.org autocaze.crabdance.com autochecker.myftp.biz autocracy.phpnet.us autocrat.comuf.com autodoor.freebyte.us autof888com.20x.cc autofseven.freei.me autogeremys.com autoinsurance.000space.com autojob.whostas.com autoken.scienceontheweb.net autolace.twilightparadox.com automachine.servequake.com automatic.waldennetworks.com automation.000a.biz automation.icr38.net automobile.000a.biz automobile.200gigs.com automobile.it.cx automobile.megabyet.net automobile.x4host.eu automobiles.strangled.net automotive.20x.cc autonomy.host22.com autopapa.noads.biz autopara.oliwy.net autoparts.phpnet.us autopatch.createandhost.com autopatch.verwalten.ch autophile.00free.net autopilot.verwalten.ch autoplant.byethost11.com autopsy.createandhost.com autoreviews.dyndns.info autorico.ignorelist.com autosadeo.000php.com autosail.ns01.biz autoshop.hostmefree.org autostart.waldennetworks.com autotest.byethost4.com autotree.freebyte.us autoup.eu.pn autoupdafree.my5gigs.com autoupdate.eg.vg autoupdate.freehostia.com autoupdate.megabyet.net autoupdate.zoka.cc autoupdatefree.freehostia.com autoupdatefree.verwalten.ch autoupdatefree.waldennetworks.com autoupdatefree.zoka.cc autoupdatefreee.my5gigs.com autoupdates.5gigs.net autoupdatfreeee.coolwwweb.com autoupgrade.awardspace.biz autovita.xtreemhost.com autovonmanstein.x10.mx autoworld.serveblog.net autozone.000space.com begatrendsone.com begatrials.com bizannounce.com blonze.createandhost.com bluecat.biz.nf bluemagazines.servegame.com bokselpa.dasfree.com checkingvirusscan.com clus89.crabdance.com codec.servepics.com control.wrizx.net cranseme.ignorelist.com crazymand.twilightparadox.com crendesting.strangled.net dailybread.waldennetworks.com dailyissue.net dailynews.000page.com dailypatch-rnr2008.net dailysummary.net dailyupdate.110mb.com domainmanagemenet.com donatewa.phpnet.us downsw.onlinewebshop.net dpc.servegame.com ds505cam.com ebizcentres.com elibrarycentre.com err.cloins.com eztwt.com fame.mooo.com fashions.0fees.net foreignaffair.org gamepia008.my5gigs.com genelousmanis.phpnet.us generalemountina.com genuinsman.phpnet.us gigahermes.com gigamiros.zyns.com gigathread.itemdb.com gigatrend.org giveaway.6te.net goathoney.biz goizmi.ignorelist.com goizmi.phpnet.us goldblacktree.waldennetworks.com gphpnet.phpnet.us greatechangemind.com greenlabelstud.000space.com gurunichi.createandhost.com halemdus.000space.com heinzmarket.com hotemup.icr38.net humanforum.net hummfoundation.org individuals.sytes.net infonetworks.biz innewsmessenger.com jackie311.byethost16.com jandas.byethost7.com javaupdate.flashserv.net jonejokoss.byethost6.com jonemaccane1.byethost7.com jpnspts.biz jpqueen.biz kaoal.chickenkiller.com laborsforum.org lakers.jumpingcrab.com limited.000space.com lookasjames.000space.com mansgepitostraig.com mechanicalcomfort.net microalba.serveftp.com microblo5.mooo.com microbrownys.strangled.net microchiefs.twilightparadox.com microchisk.mooo.com microchsse.strangled.net microdelta.crabdance.com microgenuinsman.servebeer.com microjonjokoss.jumpingcrab.com microlilics.000space.com microlilics.crabdance.com micromacrarusn.com micromacs.org micromichi.ezua.com micromps1.net micronames.jumpingcrab.com micronao.hopto.org micronaoko.jumpingcrab.com microos.jumpingcrab.com microplants.strangled.net microsoft-xpupdate.com microyours.ignorelist.com minshatopas12.org msdn4updates.com mshotfix.com msupdates.com myhome.serveuser.com myphone.freei.me nanogalsman.org nanomicsoft.com nanoocspos.com nanosleepss.net ncnbroadcasting.reportinside.net neao.biz neosilba.com new.freecinemaworld.net new.islamicawaken.com newsagencypool.com newsdailyinhk.com newsups.000a.biz nokasblog.agilityhoster.com office-revision.com online.usean.biz outlookz.com pb.enewslive.org pb.qocp.net pb.upinfo.biz photo.eonlineworld.com popin.0fees.net private.neao.biz proteingainer.biz rainbowbbs.mywebcommunity.org rayp.biz re.policyforums.org redblacksleep.createandhost.com redlooksman.servehttp.com reportinshop.com reportinside.net rootca.000space.com sales.eu5.org secureonline.net self-makeups.com self-makingups.com sellingconnection.org sens.humanforum.net shndia.com silverbell.000space.com sipapals.servehalflife.com smartappactiv.com smartnewup.crabdance.com sourcecodecenter.org spotnews.com st.cloins.com stloelementry.200gigs.com students.serveblog.net terryblog.110MB.com thenewesthta.mypressonline.com thirdbase.bugs3.com todaynewscentre.net trade-inf.com unknown12.ignorelist.com updaairpush.ignorelist.com updaily.biz.nf updaily.phpnet.us updaisin.net16.net updalsim.freehostee.com updarling.000a.biz updatable.20x.cc updateall.000a.biz updatecache.net updatefast.000a.biz updateiphone.20x.cc updateitunes.waldennetworks.com · 20 more in this batch, in the JSON
Further reading 31
- attack.mitre.org/groups/G0012
- learn.microsoft.com/en-us/microsoft-365/security/intelligen…
- media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/080…
- query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWxPuf
- securelist.com/darkhotels-attacks-in-2015/71713
- microsoft.com/security/blog/2016/06/09/reverse-engine…
- microsoft.com/security/blog/2016/06/20/reverse-engine…
- microsoft.com/security/blog/2016/07/14/reverse-engine…
- securelist.com/blog/research/66779/the-darkhotel-apt
- virustotal.com/gui/file/da0c905ab56f598c50573495085657…
- securelist.com/chrome-0-day-exploit-cve-2019-13720-use…
- mp.weixin.qq.com/s/nyxZFXgrtm2-tBiV3-wiMg
- otx.alienvault.com/pulse/627b9aa3b3842d989f57bfe6
- s.tencent.com/research/report/741.html (Chinese)
- twitter.com/blackorbird/status/1263843202311663616
- twitter.com/ximo2006/status/1142983148893954048
- insight-jp.nttsecurity.com/post/102ho8o/operation-restylink (Japan…
- otx.alienvault.com/pulse/5cee9ffe72473a4c259773b7
- trellix.com/en-us/about/newsroom/stories/threat-lab…
- otx.alienvault.com/pulse/5f34088f58d80664ae9fbd1c
- antiy.cn/research/notice&report/research_report/…
- blogs.jpcert.or.jp/ja/2019/05/darkhotel_lnk.html (Japanese)
- ti.360.net/blog/articles/analyzing-attack-of-cve-2…
- securelist.com/ie-and-windows-zero-day-operation-power…
- blog.nsfocus.net/darkhotel-3-0908
- virustotal.com/gui/file/f699f5c8ea766afe9cffcff198d135…
- otx.alienvault.com/pulse/5dbc5ca2e4310e29af9612e3
- researchcenter.paloaltonetworks.com/2018/09/unit42-traps-prevents-wild-vbsc…
- twitter.com/blackorbird/status/1178491520518770688
- twitter.com/blackorbird/status/1245597745403969544
- virustotal.com/gui/file/6048f17c1271c0f946225ec6a3d1f4…