According to Kaspersky Lab, the Dark Hotel group may have been stealing confidential documents out of the secured computers of travelling executives since 2007. Researchers believe that the group is Korean in origin (in part) because variants of the malware were designed to shut down and remove itself from the host system if the infected system code page was set to Korean. Further, the kernel mode keylogger used in Dark Hotel group attacks has Korean characters in its code and may be tied to a South Korean programmer. Since the group still targets North Koreans, one could suppose the Dark Hotel group originates in South Korea. The Dark Hotel group attack campaigns use a sophisticated keylogger and extensive infrastructure to steal confidential information directly relevant to South Korea from employees of other nations. Consequently, there is a strong likelihood that Dark Hotel group is a partially or fully state sponsored threat actor. Dark Hotel group associated names are Tapaoux, Nemim, Pioneer, Karba.
The Dark Hotel group targets high-profile executives, sales and marketing employees, R&D staff, and government employees from North Korea, Japan, India, and the United States. Notably, targets tend to be from the Asian nations with nuclear capabilities and the Unites States. Dark Hotel group often targets guests staying at luxury hotels in Asia. A smaller number of hotels in the United States have also been infected. Overall, fewer than two dozen hotel network compromises have been discovered, but it is possible that many breaches remain undiscovered or unreported. Hotels appear to be targeted based on the expectation that specific individuals will be staying there in the near future. Evidence suggests that the adversary possesses knowledge of the personal information of targets, at which hotel individual targets will stay, and the duration of their stay. The attacks may target specific individuals or all individuals who try to connect within a specific period. It is possible that the hotel attacks target those unlikely to fall for a spear phishing campaign. Specific targets may be located based on their Wi-Fi connection in the network, which is often secured with a password created from their surname and room number. Either the actor targets the hotel network directly or on occasion, it compromises the third party that manages the Wi-Fi for multiple hotels. The malware is distributed across the network either before the staff arrives to work or after they leave. When the target concludes their stay, the adversary removes all or most traces of the attack from the hotel network. Neither backdoors nor tools are left behind.
