fbpx

Darkhotel Attackers Target CEOs

Hackers
have developed a scheme to steal sensitive information from top
executives by penetrating the Wi-Fi networks of luxury hotels,
security researchers said Monday.






Dubbed
the “Darkhotel APT,” the threat actors use three different
malware distribution methods, including malicious Wi-Fi networks,
booby-trapped P2P torrents, and highly customized spear phishing,
Kaspersky Lab noted in research paper. 






Kaspersky
said about 90 percent of the infections appear to be located in
Japan, Taiwan, China, Russia and South Korea, but that the executives
targeted include those traveling from the United States and other
countries.







“The
more interesting traveling targets include top executives from the US
and Asia doing business and investment in the (Asia-Pacific) region.”






The
attackers’ methods include the use of zero-day exploits to target
executives in spear-phishing attacks as well as a kernel-mode
keystroke logger to siphon data from victim machines. They also
managed to crack weak digital signing keys to generate certificates
for signing their malware, in order to make malicious files appear to
be legitimate software. 






Obviously,
we’re not dealing with an average actor,” says Raiu. “This is a
top-class threat actor. Their ability to do the kernel-mode key
logger is rare, the reverse engineering of the certificate, the
leveraging of zero days—that puts them in a special category.”






These
types of attacks were first recorded in 2007, but activity spiked in
August 2010 and has continued through to this year, the research
found. Executives from electronics makers, pharmaceutical companies
and military organizations were among the targets.






The
key-logging tool’s code is written in Korean, but Kaspersky said this
did not necessarily mean the hackers were from Korea. It was also
difficult at this stage in the investigation to tell if the attacks
were state-backed, Raiu added.






The
number of hotels that have been hit is also unknown. So far the
researchers have found fewer than a dozen hotels with infection
indicators. “Maybe there are some hotels that … use to be
infected and we just cannot learn about that because there are no
traces,” the network-management executive says. 






The
company worked with Kaspersky to scour all of the hotel servers it
manages for any traces of malware and are “fairly confident that
the malware doesn’t sit on any hotel server today.” But that is
just one network-management company. Presumably, the DarkHotel
operation is still active on other networks.

Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

Top Tips To Avoid Getting Scammed In Sports Wagering Sites

If you’re a sports fan, you’ve probably wanted to dabble into the world of sports wagering. Who wouldn’t? Just the idea of being able...

5 Security Apps to Protect your Phone from Hackers

Our phones are much more than just communication devices these days. They save all of our personal, financial, and private information. Losing access to...

Ways to Improve Internet Speed

A slow-speed internet that makes you wait for ages before you can finally access a webpage is surely quite a pain! It tests your...

How to Reduce Risk with Runtime Application Self Protection

Instead of waning, cyber attacks continue to rise as the years pass. Several reasons contribute to this phenomenon, despite developing and deploying more robust...