Darkhotel Attackers Target CEOs

Hackers
have developed a scheme to steal sensitive information from top
executives by penetrating the Wi-Fi networks of luxury hotels,
security researchers said Monday.






Dubbed
the “Darkhotel APT,” the threat actors use three different
malware distribution methods, including malicious Wi-Fi networks,
booby-trapped P2P torrents, and highly customized spear phishing,
Kaspersky Lab noted in research paper. 






Kaspersky
said about 90 percent of the infections appear to be located in
Japan, Taiwan, China, Russia and South Korea, but that the executives
targeted include those traveling from the United States and other
countries.







“The
more interesting traveling targets include top executives from the US
and Asia doing business and investment in the (Asia-Pacific) region.”






The
attackers’ methods include the use of zero-day exploits to target
executives in spear-phishing attacks as well as a kernel-mode
keystroke logger to siphon data from victim machines. They also
managed to crack weak digital signing keys to generate certificates
for signing their malware, in order to make malicious files appear to
be legitimate software. 






Obviously,
we’re not dealing with an average actor,” says Raiu. “This is a
top-class threat actor. Their ability to do the kernel-mode key
logger is rare, the reverse engineering of the certificate, the
leveraging of zero days—that puts them in a special category.”






These
types of attacks were first recorded in 2007, but activity spiked in
August 2010 and has continued through to this year, the research
found. Executives from electronics makers, pharmaceutical companies
and military organizations were among the targets.






The
key-logging tool’s code is written in Korean, but Kaspersky said this
did not necessarily mean the hackers were from Korea. It was also
difficult at this stage in the investigation to tell if the attacks
were state-backed, Raiu added.






The
number of hotels that have been hit is also unknown. So far the
researchers have found fewer than a dozen hotels with infection
indicators. “Maybe there are some hotels that … use to be
infected and we just cannot learn about that because there are no
traces,” the network-management executive says. 






The
company worked with Kaspersky to scour all of the hotel servers it
manages for any traces of malware and are “fairly confident that
the malware doesn’t sit on any hotel server today.” But that is
just one network-management company. Presumably, the DarkHotel
operation is still active on other networks.

Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

Blind SQL Injection Tutorial to Hack a Website

In the previous article, we have the basics of SQL Injection; what SQLi is and what are the types of SQL injection. And, In...

What is SQL Injection? Tutorial: Type and Example

What is SQL injection, and what are the types of SQL injection? These are the common questions, and we will seek the answer to...

Are Cisco 300-410 Exam and Its Related Certification Your Pathway to Career Success? Find Out about This

Introduction Career success can mean different things to different people. For some, it could mean having a prestigious title and for others, it could be...

How to Hack Windows 10 Password Using FakeLogonScreen in Kali Linux

This article demonstrates an in-depth guide on how to hack Windows 10 Passwords using FakeLogonScreen. Hacking Windows 10 password is an exciting topic and...