{ "id": "69154029-a618-4a8e-bf58-e4b9a5b67d1e", "created_at": "2026-04-06T00:16:25.846423Z", "updated_at": "2026-04-10T13:12:03.881676Z", "deleted_at": null, "sha1_hash": "30b1d28053815c933a53369afbfec84cde28e735", "title": "‘DarkHotel’ APT Uses New Methods to Target Politicians", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 75917, "plain_text": "‘DarkHotel’ APT Uses New Methods to Target Politicians\r\nBy Eduard Kovacs\r\nPublished: 2017-07-19 · Archived: 2026-04-05 14:38:36 UTC\r\nThe DarkHotel threat group has been using some new methods in attacks aimed at government employees\r\nwith an interest in North Korea, according to a report published this week by security firm Bitdefender.\r\nThe activities of the DarkHotel advanced persistent threat (APT) actor came to light in November 2014, when\r\nKaspersky published a report detailing a sophisticated cyber espionage campaign targeting business travelers in\r\nthe Asia-Pacific region. The group has been around for nearly a decade and some researchers believe its members\r\nare Korean speakers.\r\nThe attackers targeted their victims using several methods, including through their hotel’s Wi-Fi, zero-day exploits\r\nand peer-to-peer (P2P) file sharing websites. Nearly one year later, the threat group was observed using new attack\r\ntechniques and an exploit leaked from Italian spyware maker Hacking Team.\r\nDarkHotel victims have been spotted in several countries, including North Korea, Russia, South Korea, Japan,\r\nBangladesh, Thailand, Taiwan, China, the United States, India, Mozambique, Indonesia and Germany. Up until\r\nrecently, the attacks appeared to focus on company executives, researchers and development personnel from\r\nsectors such as defense industrial base, military, energy, government, NGOs, electronics manufacturing,\r\npharmaceutical, and medical.\r\nIn more recent DarkHotel attacks it has dubbed “Inexsmar,” security firm Bitdefender said the hackers targeted\r\npolitical figures, and they appeared to be using some new methods.\r\nBitdefender’s analysis is based on samples from September 2016. The initial Trojan downloader, delivered via\r\nphishing emails, collects information on the infected device and sends it back to its command and control (C\u0026C)\r\nserver. If the compromised system meets requirements (i.e. it belongs to an individual who is of interest), the first\r\nstage DarkHotel downloader, disguised as a component of OpenSSL, is fetched.\r\nAdvertisement. Scroll to continue reading.\r\nhttps://www.securityweek.com/darkhotel-apt-uses-new-methods-target-politicians\r\nPage 1 of 2\n\nIn the meantime, in an effort to avoid raising suspicion, the malware opens a document titled “Pyongyang e-mail\r\nlists – September 2016,” which provides a list of email contacts for various organizations in North Korea’s capital\r\ncity.\r\nIf the system profile does not match what the attackers are looking for, the C\u0026C server returns a “fail” string and\r\nthe attack stops. If the attack continues, a second payload is retrieved.\r\nWhen Bitdefender analyzed the malware samples, the C\u0026C server was offline, making it impossible to know\r\nexactly who the victims were and how much damage was caused. However, Bitdefender’s Bogdan Botezatu told\r\nSecurityWeek that, based on the structure of the phishing message, the intended targets are most likely individuals\r\nworking for governments or state institutions who have an interest in the political situation in North Korea.\r\nExperts believe that the use of social engineering and a multi-stage downloader is an improvement compared to\r\nthe direct use of exploits as it gives the attackers more flexibility in malware distribution and ensures that the\r\nTrojan remains up to date.\r\nRelated: Jaku Botnet – Active Operation With Possible Links to Darkhotel APT Group\r\nSource: https://www.securityweek.com/darkhotel-apt-uses-new-methods-target-politicians\r\nhttps://www.securityweek.com/darkhotel-apt-uses-new-methods-target-politicians\r\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA", "MISPGALAXY", "Malpedia" ], "origins": [ "web" ], "references": [ "https://www.securityweek.com/darkhotel-apt-uses-new-methods-target-politicians" ], "report_names": [ "darkhotel-apt-uses-new-methods-target-politicians" ], "threat_actors": [ { "id": "1dadf04e-d725-426f-9f6c-08c5be7da159", "created_at": "2022-10-25T15:50:23.624538Z", "updated_at": "2026-04-10T02:00:05.286895Z", "deleted_at": null, "main_name": "Darkhotel", "aliases": [ "Darkhotel", "DUBNIUM", "Zigzag Hail" ], "source_name": "MITRE:Darkhotel", "tools": null, "source_id": "MITRE", "reports": null }, { "id": "a3687241-9876-477b-aa13-a7c368ffda58", "created_at": "2022-10-25T16:07:24.496902Z", "updated_at": "2026-04-10T02:00:05.010744Z", "deleted_at": null, "main_name": "Hacking Team", "aliases": [], "source_name": "ETDA:Hacking Team", "tools": [], "source_id": "ETDA", "reports": null }, { "id": "e90c06e4-e3e0-4f46-a3b5-17b84b31da62", "created_at": "2023-01-06T13:46:39.018236Z", "updated_at": "2026-04-10T02:00:03.183123Z", "deleted_at": null, "main_name": "Hacking Team", "aliases": [], "source_name": "MISPGALAXY:Hacking Team", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "b13c19d6-247d-47ba-86ba-15a94accc179", "created_at": "2024-05-01T02:03:08.149923Z", "updated_at": "2026-04-10T02:00:03.763147Z", "deleted_at": null, "main_name": "TUNGSTEN BRIDGE", "aliases": [ "APT-C-06 ", "ATK52 ", "CTG-1948 ", "DUBNIUM ", "DarkHotel ", "Fallout Team ", "Shadow Crane ", "Zigzag Hail " ], "source_name": "Secureworks:TUNGSTEN BRIDGE", "tools": [ "Nemim", "Tapaoux" ], "source_id": "Secureworks", "reports": null }, { "id": "2b4eec94-7672-4bee-acb2-b857d0d26d12", "created_at": "2023-01-06T13:46:38.272109Z", "updated_at": "2026-04-10T02:00:02.906089Z", "deleted_at": null, "main_name": "DarkHotel", "aliases": [ "T-APT-02", "Nemim", "Nemin", "Shadow Crane", "G0012", "DUBNIUM", "Karba", "APT-C-06", "SIG25", "TUNGSTEN BRIDGE", "Zigzag Hail", "Fallout Team", "Luder", "Tapaoux", "ATK52" ], "source_name": "MISPGALAXY:DarkHotel", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "c0cedde3-5a9b-430f-9b77-e6568307205e", "created_at": "2022-10-25T16:07:23.528994Z", "updated_at": "2026-04-10T02:00:04.642473Z", "deleted_at": null, "main_name": "DarkHotel", "aliases": [ "APT-C-06", "ATK 52", "CTG-1948", "Dubnium", "Fallout Team", "G0012", "G0126", "Higaisa", "Luder", "Operation DarkHotel", "Operation Daybreak", "Operation Inexsmar", "Operation PowerFall", "Operation The Gh0st Remains the Same", "Purple Pygmy", "SIG25", "Shadow Crane", "T-APT-02", "TieOnJoe", "Tungsten Bridge", "Zigzag Hail" ], "source_name": "ETDA:DarkHotel", "tools": [ "Asruex", "DarkHotel", "DmaUp3.exe", "GreezeBackdoor", "Karba", "Nemain", "Nemim", "Ramsay", "Retro", "Tapaoux", "Trojan.Win32.Karba.e", "Virus.Win32.Pioneer.dx", "igfxext.exe", "msieckc.exe" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434585, "ts_updated_at": 1775826723, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/30b1d28053815c933a53369afbfec84cde28e735.pdf", "text": "https://archive.orkl.eu/30b1d28053815c933a53369afbfec84cde28e735.txt", "img": "https://archive.orkl.eu/30b1d28053815c933a53369afbfec84cde28e735.jpg" } }