What it is
DarkHotel is the name used for a long-running cyberespionage group and related campaigns targeting executives, government personnel, and other high-value individuals. It became known for combining targeted phishing with attacks involving hotel or travel environments, although later activity has used a broader set of delivery methods.
How it works
Operators research selected victims and deliver malicious documents, links, or software updates that appear relevant to their work or travel. A successful infection can install backdoors, collect documents and credentials, and maintain quiet access. The campaign name covers activity observed over time, so tools and infrastructure can change between incidents.
Key points
Public Wi-Fi alone is not proof of a DarkHotel attack; attribution requires technical and contextual evidence.
Executives and traveling staff face higher risk when they handle sensitive material on unmanaged networks.
Signed or professionally written files can still be malicious when a trusted account or certificate is abused.
What to do
Use managed devices, a trusted VPN, MFA, and current software when traveling.
Verify unexpected documents or update prompts through a separate communication channel.
Collect email, endpoint, and network evidence before removing suspected implants.
Rotate exposed credentials and review access to sensitive repositories after a confirmed compromise.
Travel security reduces the opportunity
Use a fully updated device with full-disk protection, avoid administrator work for email and browsing, and treat hotel or conference networks as untrusted. Verify update prompts through the software vendor rather than a captive portal. Use a trusted VPN where policy permits, disable unnecessary sharing, and keep sensitive work separate from a travel device. If a targeted attachment or installer ran, isolate the system and preserve it for investigation instead of only deleting the visible file. Review phishing entry points and protect important accounts with MFA.