Home / Threat actors / Darkhotel
Darkhotel G0012
Also known as: DUBNIUM, Zigzag Hail
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
1
associated CVEs
30
Techniques
0
Malware and tools
Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“Darkhotel has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.”
Techniques by tactic
Initial Access
T1091 Replication Through Removable MediaT1189 Drive-by CompromiseT1566.001 Spearphishing Attachment Execution
T1059.003 Windows Command ShellT1203 Exploitation for Client ExecutionT1204.002 Malicious File Persistence
T1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1547.001 Registry Run Keys / Startup Folder Stealth
T1027.013 Encrypted/Encoded FileT1036.005 Match Legitimate Resource Name or LocationT1140 Deobfuscate/Decode Files or InformationT1497 Virtualization/Sandbox EvasionT1497.001 System ChecksT1497.002 User Activity Based Checks Defense Impairment
T1553.002 Code Signing Credential Access
T1056.001 Keylogging Discovery
T1016 System Network Configuration DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1124 System Time DiscoveryT1497 Virtualization/Sandbox EvasionT1497.001 System ChecksT1497.002 User Activity Based ChecksT1518.001 Security Software Discovery Lateral Movement
T1080 Taint Shared ContentT1091 Replication Through Removable Media Collection
T1056.001 Keylogging Command and Control
T1105 Ingress Tool TransferT1573.001 Symmetric Cryptography © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.