Quick answer: DarkHotel is the name given to a long-running cyberespionage threat group known for targeting executives, government personnel, and other selected victims. Documented operations included compromised hotel internet portals, spearphishing, malicious files, stolen or abused code-signing trust, and multi-stage payloads.
What is DarkHotel?
MITRE ATT&CK tracks Darkhotel as group G0012 and lists DUBNIUM and Zigzag Hail as associated names. MITRE says the group has operated since at least 2004 and primarily targeted victims in East Asia. The name came from campaigns against selected guests through hotel internet networks, but the group’s activity is not limited to hotels.
Threat-group attribution is an analytical assessment, not a permanent identity label. Different researchers may group activity differently as infrastructure, malware, and evidence change. Defenders should prioritize observed techniques and indicators from the relevant incident.
How the hotel attack worked
Historical reporting described compromised hotel login portals that identified and redirected selected users toward malicious software presented as a legitimate update. The approach exploited both a network the traveler expected to use and a moment when update prompts might seem plausible. Only selected high-value devices received the later payload, reducing unnecessary exposure.
Using a hotel network does not automatically mean the hotel is malicious, and a VPN alone cannot make a malicious update safe if the user installs it. The core defense is to avoid unverified software and separate travel activity from privileged corporate access.
Documented techniques
- Spearphishing attachments, including archive, shortcut, and office-file delivery.
- Drive-by compromise and malicious redirects through compromised web infrastructure.
- Downloaders that retrieve additional payloads after selecting a target.
- Registry run keys or startup locations for persistence.
- Keylogging, system and process discovery, file discovery, and encrypted command communication.
- Code signing with stolen certificates or trust abuse, plus sandbox and user-activity checks.
These techniques are historical observations, not a list guaranteed to appear in every future campaign.
Travel security checklist
- Use a dedicated, fully patched travel device with the minimum data and privileges needed.
- Install operating-system, browser, VPN, and application updates before travel from verified sources.
- Do not install software offered by a hotel portal, pop-up, QR code, removable drive, or unsolicited message.
- Use organization-approved remote access with phishing-resistant MFA. Treat every local network as untrusted.
- Disable unnecessary sharing, discovery, Bluetooth, and automatic connection; use a host firewall and encrypted storage.
- Avoid privileged administration and sensitive development work from the travel device when possible.
Organizational defenses
Use application control, endpoint behavioral monitoring, email sandboxing, DNS and web filtering, and protected centralized logs. Establish a travel-device loaner and post-travel inspection process for high-risk roles. Monitor unusual certificate use, office-to-script execution, new autoruns, archive and shortcut delivery, and rare outbound destinations.
If compromise is suspected
Disconnect the device without using it for further authentication. Preserve the file, portal URL, email, process tree, certificate, network logs, and travel timeline. Revoke exposed sessions and credentials from a clean system, hunt related endpoints, and reimage when integrity is uncertain. Notify the organization’s security team; do not confront local staff or attribute the event based only on location.
Source
Group history and documented techniques are maintained in the MITRE ATT&CK Darkhotel entry, updated July 2026.