Darkhotel

DarkHotel is a cyber-espionage actor active since at least 2007, also tracked under names including APT-C-06, Dubnium, Fallout Team, Nemim, and Tapaoux. Its targets include government officials, political figures, corporate executives, sales personnel, and research and development staff, particularly travelers in the Asia-Pacific region. The actor became widely known for compromising hotel networks to selectively infect high-profile guests rather than indiscriminately targeting all network users. DarkHotel uses spearphishing, malicious Office documents, RAR archives, and Windows shortcuts to deliver exploits and multistage malware. Its exploitation history includes CVE-2014-0497 and the Internet Explorer VBScript vulnerabilities CVE-2018-8174 and CVE-2018-8373, both used as zero-days. It has embedded Internet Explorer content in Word documents to load malicious web pages and execute VBScript in contexts that remained available despite browser restrictions. It has also distributed trojanized software and propagated malware by infecting executables on shared drives. Its malware ecosystem includes the modular Lucker and Retro backdoor families. Documented capabilities include keylogging, audio recording, screenshots, file collection, host and network discovery, and downloading additional modules. Intrusion chains have used PowerShell, Windows command shells, UAC bypass, DLL hijacking, and reflective in-memory payload loading. RC4, XOR, and RSA obfuscation, runtime decryption of strings and imports, and image steganography conceal code and payloads. APT-C-60 is another supplied tracking name associated with DarkHotel. Activity under that designation targeted Japanese organizations in 2026 using phishing-delivered archives and shortcuts, obfuscated JavaScript, legitimate Windows components, and developer services to deliver SpyGlace. These chains abused GitHub, GitLab, jsDelivr, and Codeberg for payload staging and used legitimate Git software during execution.