AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Darkhotel
Aliases: DUBNIUM, Darkhotel, Zigzag Hail
[Darkhotel](https://attack.mitre.org/groups/G0012) is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. [Darkhotel](https://attack.mitre.org/groups/G0012) has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.(Citation: Kaspersky Darkhotel)(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft Digital Defense FY20 Sept 2020)
Open interactive actor investigation
ATT&CK techniques
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.013 Encrypted/Encoded File simulation — Exact active technique ID
- T1027.013 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1056.001 Keylogging simulation — Exact active technique ID
- T1056.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1080 Taint Shared Content simulation — Exact active technique ID
- T1080 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1091 Replication Through Removable Media simulation — Exact active technique ID
- T1091 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1124 System Time Discovery simulation — Exact active technique ID
- T1124 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1189 Drive-by Compromise simulation — Exact active technique ID
- T1189 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1497 Virtualization/Sandbox Evasion simulation — Exact active technique ID
- T1497 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1497.001 System Checks simulation — Exact active technique ID
- T1497.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1497.002 User Activity Based Checks simulation — Exact active technique ID
- T1497.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518.001 Security Software Discovery simulation — Exact active technique ID
- T1518.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1553.002 Code Signing simulation — Exact active technique ID
- T1553.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1573.001 Symmetric Cryptography simulation — Exact active technique ID
- T1573.001 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Vulnerability Research & Exploit Development · explicit-idModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameModule 10 — Cloud, containers, Kubernetes, and SaaS defense
Blue Team & Defensive Security · topic-matchModule 1 — Mission, authorization, and methodology
Red Team & Offensive Security · topic-matchDisk, file-system, and persistence forensics
Digital Forensics & Incident Response (DFIR) · topic-matchPublic code, packages, cloud artifacts, documents, and exposed secrets
OSINT & Reconnaissance · topic-matchPrompt injection, instruction hierarchy, and secure output handling
AI Security · topic-matchSecure AI development lifecycle and production release gate
AI Security · topic-matchModule 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · topic-matchModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · topic-matchModule 2 — Asset, service, identity, and exposure context
Blue Team & Defensive Security · topic-matchModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · topic-match