Trusted Design

Darkhotel

G0012 · MITRE Pageへのリンク

脅威アクターの詳細

[Darkhotel](https://attack.mitre.org/groups/G0012) is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. [Darkhotel](https://attack.mitre.org/groups/G0012) has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.(Citation: Kaspersky Darkhotel)(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft Digital Defense FY20 Sept 2020)

別名・別称

Darkhotel
DUBNIUM
Zigzag Hail

利用した攻撃手法

• T1056.001 - Keylogging
• T1027.013 - Encrypted/Encoded File
• T1036.005 - Match Legitimate Resource Name or Location
• T1204.002 - Malicious File
• T1080 - Taint Shared Content
• T1573.001 - Symmetric Cryptography
• T1497.001 - System Checks
• T1566.001 - Spearphishing Attachment
• T1553.002 - Code Signing
• T1082 - System Information Discovery
• T1091 - Replication Through Removable Media
• T1140 - Deobfuscate/Decode Files or Information
• T1016 - System Network Configuration Discovery
• T1083 - File and Directory Discovery
• T1497 - Virtualization/Sandbox Evasion
• T1057 - Process Discovery
• T1497.002 - User Activity Based Checks
• T1547.001 - Registry Run Keys / Startup Folder
• T1203 - Exploitation for Client Execution
• T1518.001 - Security Software Discovery
• T1059.003 - Windows Command Shell
• T1189 - Drive-by Compromise
• T1105 - Ingress Tool Transfer
• T1124 - System Time Discovery

関連するCVE (攻撃手法に関連)

• CVE-2025-55182 (T1083)
• CVE-2023-1389 (T1497.002)
• CVE-2025-13928 (T1497.002)
• CVE-2025-24893 (T1203)
• CVE-2025-34026 (T1203)
• CVE-2025-55184 (T1083)
• CVE-2025-68645 (T1083)
• CVE-2016-1898 (T1027.013)
• CVE-2016-1897 (T1027.013)
• CVE-2015-0932 (T1027.013)
• CVE-2014-4114 (T1203)
• CVE-2015-1770 (T1203)
• CVE-2015-2545 (T1083)
• CVE-2017-0199 (T1203)
• CVE-2012-0158 (T1203)
• CVE-2013-3906 (T1203)
• CVE-2014-6352 (T1203)
• CVE-2015-0016 (T1203)
• CVE-2010-3333 (T1203)
• CVE-2010-0188 (T1059.003)
• CVE-2010-2884 (T1059.003)
• CVE-2013-0640 (T1059.003)
• CVE-2011-0611 (T1059.003)
• CVE-2009-3129 (T1083)
• CVE-2010-1553 (T1566.001)
• CVE-2014-1761 (T1203)
• CVE-2015-2853 (T1203)
• CVE-2017-16929 (T1083)
• CVE-2012-1876 (T1203)
• CVE-2012-2539 (T1203)
• CVE-2013-3660 (T1083)
• CVE-2013-7331 (T1083)
• CVE-2013-5990 (T1203)
• CVE-2015-0310 (T1203)
• CVE-2014-6332 (T1203)
• CVE-2010-0806 (T1105)
• CVE-2015-5122 (T1203)
• CVE-2015-3043 (T1203)
• CVE-2015-3456 (T1016)
• CVE-2015-3090 (T1203)
• CVE-2016-0984 (T1497.002)
• CVE-2015-0313 (T1203)
• CVE-2014-0329 (T1083)
• CVE-2015-5134 (T1497.002)
• CVE-2015-5539 (T1497.002)
• CVE-2015-5557 (T1497.002)
• CVE-2015-5563 (T1497.002)
• CVE-2015-5559 (T1497.002)
• CVE-2015-5540 (T1497.002)
• CVE-2015-5561 (T1497.002)
• CVE-2015-5551 (T1497.002)
• CVE-2015-5564 (T1497.002)
• CVE-2015-5565 (T1497.002)
• CVE-2015-5550 (T1497.002)
• CVE-2015-5566 (T1497.002)
• CVE-2015-5127 (T1497.002)
• CVE-2015-5556 (T1497.002)
• CVE-2015-3628 (T1203)
• CVE-2016-1287 (T1497.002)
• CVE-2015-8287 (T1203)
• CVE-2016-2342 (T1497.002)
• CVE-2012-0507 (T1083)
• CVE-2014-8439 (T1497.002)
• CVE-2013-2551 (T1189)
• CVE-2014-0569 (T1497.002)
• CVE-2026-20127 (T1083)
• CVE-2015-5119 (T1203)
• CVE-2012-1856 (T1203)
• CVE-2015-2546 (T1083)
• CVE-2015-3785 (T1497.002)
• CVE-2015-5897 (T1497.002)
• CVE-2015-3113 (T1203)
• CVE-2015-2590 (T1083)
• CVE-2015-2424 (T1083)
• CVE-2015-0097 (T1083)
• CVE-2015-4495 (T1189)
• CVE-2015-2502 (T1189)
• CVE-2014-6271 (T1059.003)
• CVE-2014-4113 (T1083)
• CVE-2016-1990 (T1497.002)
• CVE-2016-1991 (T1497.002)
• CVE-2016-1010 (T1203)
• CVE-2016-1019 (T1083)
• CVE-2016-1001 (T1203)
• CVE-2016-0998 (T1203)
• CVE-2015-1641 (T1083)
• CVE-2015-1701 (T1083)
• CVE-2015-0359 (T1203)
• CVE-2015-5130 (T1497.002)
• CVE-2015-2852 (T1203)
• CVE-2015-2854 (T1203)
• CVE-2012-4969 (T1059.003)
• CVE-2015-6022 (T1497.002)
• CVE-2017-0263 (T1083)
• CVE-2017-0261 (T1083)
• CVE-2017-0262 (T1083)
• CVE-2015-0311 (T1203)
• CVE-2010-3081 (T1497.002)
• CVE-2012-3213 (T1203)
• CVE-2012-4792 (T1105)
• CVE-2014-0322 (T1189)
• CVE-2012-1258 (T1497.002)
• CVE-2015-0336 (T1203)
• CVE-2011-3544 (T1083)
• CVE-2014-3153 (T1203)
• CVE-2014-4322 (T1083)
• CVE-2015-3636 (T1497.002)
• CVE-2013-6282 (T1497.002)
• CVE-2015-3105 (T1203)
• CVE-2014-0497 (T1203)
• CVE-2017-17215 (T1083)
• CVE-2013-0074 (T1203)
• CVE-2013-2465 (T1083)
• CVE-2014-0515 (T1203)
• CVE-2014-1776 (T1203)
• CVE-2014-0556 (T1497.002)
• CVE-2015-5560 (T1497.002)
• CVE-2015-0057 (T1083)
• CVE-2015-0071 (T1189)
• CVE-2014-9163 (T1203)
• CVE-2012-1723 (T1083)
• CVE-2015-1761 (T1083)
• CVE-2014-8440 (T1497.002)
• CVE-2015-2360 (T1083)
• CVE-2014-4148 (T1083)
• CVE-2011-3402 (T1083)
• CVE-2014-6324 (T1083)
• CVE-2014-7247 (T1203)
• CVE-2013-2678 (T1083)
• CVE-2015-2426 (T1083)
• CVE-2008-1436 (T1057)
• CVE-2010-0232 (T1203)
• CVE-2010-4398 (T1083)
• CVE-2014-3393 (T1497.002)
• CVE-2014-2273 (T1497.002)
• CVE-2015-4902 (T1083)
• CVE-2014-3897 (T1189)
• CVE-2015-2387 (T1083)
• CVE-2010-2572 (T1083)
• CVE-2011-1255 (T1203)
• CVE-2017-8570 (T1083)
• CVE-2012-0611 (T1189)
• CVE-2015-2419 (T1189)
• CVE-2016-0189 (T1189)
• CVE-2016-4117 (T1203)
• CVE-2017-0001 (T1083)
• CVE-2017-0143 (T1203)
• CVE-2025-31125 (T1083)
• CVE-2025-55183 (T1083)
• CVE-2025-66478 (T1083)
• CVE-2026-0723 (T1497.002)
• CVE-2015-1427 (T1497.002)
• CVE-2015-5477 (T1497.002)
• CVE-2013-2094 (T1497.002)
• CVE-2015-8562 (T1497.002)
• CVE-2015-5749 (T1497.002)
• CVE-2015-7755 (T1203)
• CVE-2015-7261 (T1497.002)
• CVE-2015-6036 (T1497.002)
• CVE-2015-7262 (T1497.002)
• CVE-2016-1562 (T1497.002)
• CVE-2012-0056 (T1497.002)
• CVE-2014-7911 (T1497.002)
• CVE-2010-1297 (T1059.003)
• CVE-2010-2883 (T1059.003)
• CVE-2013-0634 (T1497.002)
• CVE-2012-5054 (T1497.002)
• CVE-2010-0738 (T1497.002)
• CVE-2013-0641 (T1059.003)
• CVE-2025-13335 (T1497.002)
• CVE-2025-13927 (T1497.002)
• CVE-2026-1102 (T1497.002)
• CVE-2015-7645 (T1203)
• CVE-2015-7808 (T1203)
• CVE-2016-9495 (T1203)
• CVE-2014-8361 (T1203)
• CVE-2012-4681 (T1124)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る