D
CyberSouth Korea

Darkhotel

Suspected state-linked cyber threat groupTrackedPending verification

Also known as: DUBNIUM, Zigzag Hail

CyberKOR
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeSuspected state-linked cyber threat group
Alternative designationsDUBNIUM, Zigzag Hail
ProliferationOrigin country only
Active since2004At least 2004Med[1]
MITRE ATT&CK IDG0012High[1]
Capabilities
ATT&CK techniques used24ATT&CK v20.1High[1]
Attribution and activity
Attributed sponsorSuspected South Korean groupMed[1]
TargetsDarkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004.Med[1]
Notes
Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
South Korea
Sources
  1. Darkhotel, Group G0012, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0012)