{
  "id": "darkhotel",
  "name": "Darkhotel",
  "aliases": [
    "DUBNIUM",
    "Zigzag Hail"
  ],
  "domain": "cyber",
  "country": "KOR",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "KOR"
  ],
  "summary": "Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Suspected South Korean group",
      "src": [
        "mitre-g0012"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2004,
      "src": [
        "mitre-g0012"
      ],
      "conf": "medium",
      "note": "At least 2004"
    },
    {
      "k": "attack_id",
      "v": "G0012",
      "src": [
        "mitre-g0012"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004.",
      "src": [
        "mitre-g0012"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 24,
      "src": [
        "mitre-g0012"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0012)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/darkhotel.html",
  "sources": {
    "mitre-g0012": {
      "title": "Darkhotel, Group G0012",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0012/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}