South KoreaAssessedSouth Korea-linkedEspionageActive 2004 – 2015DarkHotel
Also known asDUBNIUM · Zigzag Hail · Shadow Crane · Fallout Team · TUNGSTEN BRIDGE
Summary
Suspected South Korean espionage group (MITRE G0012) active since at least 2004, named by Kaspersky in 2014 for compromising hotel networks to reach selected guests — mostly senior executives from the US and Asia doing business in the APAC region. Kaspersky saw the hotel-network intrusions peak from August 2010 to 2013, alongside precise spear-phishing with Flash zero-days (T1566.001, T1203) and indiscriminate spreading over peer-to-peer and file-sharing networks. It signs its backdoors and downloaders with stolen certificates or certificates forged from weak keys (T1553.002), uses keyloggers (T1056.001) and Run-key persistence (T1547.001). In 2015 it phished targets in North Korea, Russia, South Korea, Japan and elsewhere, distributing the Flash zero-day leaked from Hacking Team. Sophos CTU says it targets North Korea-linked organisations and personnel and also global business executives in South Korea's national interest. Microsoft tracks it as Zigzag Hail (formerly DUBNIUM), CrowdStrike as Shadow Crane. Later reports — Qihoo 360 (2020) and Trellix (2022, Macao hotels) — could not be read here, so last_seen is 2015, the latest activity in the readable sources. Sophos also lists APT-C-06 and Thales's ATK52; they are not used here, because Microsoft's table carries a different 360 name (APT-C-60) and ATK52 has no second source.
Attribution
MITRE: suspected South Korean; Sophos CTU: moderate confidence; Microsoft lists it under Korea
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Suspected South Korean threat group - Sophos CTU (Research, 2026-10)
Operates on behalf of South Korea (moderate confidence)
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Spear-phishing with the leaked Hacking Team Flash zero-day | 2015-04 – 2015-07 | North Korea, Russia, Japan, Bangladesh, Thailand, India, Mozambique, Germany | Diplomatic, Government | Kaspersky (2015-08) — April 2015 phishing with older Flash exploits, the Hacking Team zero-day from early July; some targets diplomatic |
| Hotel-network intrusions against travelling executives | 2010-08 – 2013 | Asia, USA | Corporate travelers, Hospitality | Kaspersky (2014-11-10) — highest volume August 2010 to 2013; tools dating back to 2007 |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 5
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution1 | T1203Exploitation for Client Execution |
| Persistence1 | T1547.001Registry Run Keys / Startup Folder |
| Defense Impairment1 | T1553.002Code Signing |
| Collection1 | T1056.001Keylogging |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| Tapaoux | Backdoor | Windows |
| Nemim | Backdoor | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2015-8651 | 8.8 | Adobe Flash Player — integer overflow (KEV 2022-05-25) |
Highest CVSS first.
Infrastructure patterns
- Hotel Wi-Fi and hotel networks used to reach selected travellers (Kaspersky, 2014; Kaspersky, 2015)
- Backdoors and downloaders signed with a stockpile of stolen certificates (Kaspersky, 2015)
Reporting and advisories 4
- MITRE ATT&CK
Darkhotel (G0012) - Kaspersky
The Darkhotel APT (Nov 2014) - Kaspersky
Darkhotel's attacks in 2015 (Aug 2015) - Sophos CTU
TUNGSTEN BRIDGE threat profile