CIP Cyber

Darkhotel Attackers Target CEOs

Table of Contents

Hackers
have developed a scheme to steal sensitive information from top
executives by penetrating the Wi-Fi networks of luxury hotels,
security researchers said Monday.






Dubbed
the “Darkhotel APT,” the threat actors use three different
malware distribution methods, including malicious Wi-Fi networks,
booby-trapped P2P torrents, and highly customized spear phishing,
Kaspersky Lab noted in research paper. 






Kaspersky
said about 90 percent of the infections appear to be located in
Japan, Taiwan, China, Russia and South Korea, but that the executives
targeted include those traveling from the United States and other
countries.







“The
more interesting traveling targets include top executives from the US
and Asia doing business and investment in the (Asia-Pacific) region.”






The
attackers’ methods include the use of zero-day exploits to target
executives in spear-phishing attacks as well as a kernel-mode
keystroke logger to siphon data from victim machines. They also
managed to crack weak digital signing keys to generate certificates
for signing their malware, in order to make malicious files appear to
be legitimate software. 






Obviously,
we’re not dealing with an average actor,” says Raiu. “This is a
top-class threat actor. Their ability to do the kernel-mode key
logger is rare, the reverse engineering of the certificate, the
leveraging of zero days—that puts them in a special category.”






These
types of attacks were first recorded in 2007, but activity spiked in
August 2010 and has continued through to this year, the research
found. Executives from electronics makers, pharmaceutical companies
and military organizations were among the targets.






The
key-logging tool’s code is written in Korean, but Kaspersky said this
did not necessarily mean the hackers were from Korea. It was also
difficult at this stage in the investigation to tell if the attacks
were state-backed, Raiu added.






The
number of hotels that have been hit is also unknown. So far the
researchers have found fewer than a dozen hotels with infection
indicators. “Maybe there are some hotels that … use to be
infected and we just cannot learn about that because there are no
traces,” the network-management executive says. 






The
company worked with Kaspersky to scour all of the hotel servers it
manages for any traces of malware and are “fairly confident that
the malware doesn’t sit on any hotel server today.” But that is
just one network-management company. Presumably, the DarkHotel
operation is still active on other networks.

CIP Cyber Staff

CIP Cyber Staff

CIP Cyber Staff comprises CIP cybersecurity experts committed to delivering comprehensive information on critical infrastructure protection. The content covers diverse topics, equipping professionals to defend organizations and communities in an ever-evolving cyber landscape.

Most popular

Industrial Cybersecurity

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings

Related Articles

How to Detect Phishing Mails and Websites

Not long ago, phishing websites and mails looked quite unprofessional, they were peppered with spelling mistakes and had a distrustful design. Nowadays the digital fraudsters

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings