DarkHotel- a spy campaign in Luxury hotels

Darkhotel, one of epidemics of stealing data has recovered from the shadows while stealing data from selected corporate executive travelling abroad. Darkhotel hits its targets while they are staying in luxury hotels. The crew never goes after the same target twice; they perform operations with surgical precision, getting all the valuable data they can from the first contact, deleting traces of their work and melting into the background to await the next high profile individual. 

The most recent travelling targets include top executives from the US and Asia doing business and investing in the APAC region: CEOs, senior vice presidents, sales and marketing directors and top R&D staff have all been targeted. Who will be next? This threat actor is still active, Kaspersky Lab warns.      

The Darkhotel actor maintains an effective intrusion set on hotel networks, providing ample access over the years, even to systems that were believed to be private and secure. They wait until, after check-in, the victim connects to the hotel Wi-Fi network, submitting his room number and surname at the login. The attackers see him in the compromised network and trick him into downloading and installing a backdoor that pretends to be an update for legitimate software – Google Toolbar, Adobe Flash or Windows Messenger. The unsuspecting executive downloads this hotel “welcome package”, only to infect his machine with a backdoor, Darkhotel’s spying software.

Once on a system, the backdoor has been and may be used to further download more advanced stealing tools: a digitally-signed advanced keylogger, the Trojan ‘Karba’ and an information-stealing module. These tools collect data about the system and the anti-malware software installed on it, steal all keystrokes, and hunt for cached passwords in Firefox, Chrome and Internet Explorer; Gmail Notifier, Twitter, Facebook, Yahoo! and Google login credentials; and other private information. Victims lose sensitive information – likely the intellectual property of the business entities they represent. After the operation, the attackers carefully delete their tools from the hotel network and go back into hiding.

However, Darkhotel malicious activity can be inconsistent: it is indiscriminate in its spread of malware alongside its highly targeted attacks.

How to outsmart Darkhotel’s tricks

When traveling, any network, even semi-private ones in hotels, should be viewed as potentially dangerous. The Darkhotel case illustrates an evolving attack vector: individuals who possess valuable information can easily fall victim to Darkhotel itself, as it is still active, or to something similar to a Darkhotel attack. To prevent attack from Darkhotel, Kaspersky Lab has the following tips:

• Choose a Virtual Private Network (VPN) provider – you will get an encrypted communication channel  when accessing public or semi-public Wi-Fi;
• When traveling, always regard software updates as suspicious. Confirm that the proposed update installer is signed by the appropriate vendor.
• Make sure your Internet security solution includes proactive defense against new threats rather than just basic antivirus protection
• The attackers left a footprint in a string within their malicious code pointing to a Korean-speaking actor.