Darkhotel
IntrusionSet · ATTACK:enterprise:G0012
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0012",
"title": "Darkhotel",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0012",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--9e729a7e-0dd6-4097-95bf-db8d64911383",
"external_id": "G0012",
"domain": "enterprise",
"created": "2017-05-31T21:31:50.624Z",
"modified": "2026-07-31T18:48:11.260Z",
"version": "3.0",
"aliases": [
"Darkhotel",
"DUBNIUM",
"Zigzag Hail"
],
"tactics": [
],
"source_references": [
{
"source_name": "Darkhotel"
},
{
"source_name": "DUBNIUM"
},
{
"source_name": "Zigzag Hail"
},
{
"source_name": "Securelist Darkhotel Aug 2015",
"url": "https://securelist.com/darkhotels-attacks-in-2015/71713/"
},
{
"source_name": "Kaspersky Darkhotel",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf"
},
{
"source_name": "Microsoft Digital Defense FY20 Sept 2020",
"url": "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWxPuf"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft DUBNIUM July 2016",
"url": "https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"
},
{
"source_name": "Microsoft DUBNIUM Flash June 2016",
"url": "https://www.microsoft.com/security/blog/2016/06/20/reverse-engineering-dubniums-flash-targeting-exploit/"
},
{
"source_name": "Microsoft DUBNIUM June 2016",
"url": "https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/"
}
]
}Explicit source assertions (24)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02052736-4888-47b0-9eb4-4031a4061998
Securelist Darkhotel Aug 2015 · Microsoft DUBNIUM June 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1497.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--118b2047-826a-4ab0-94b8-69d35a4c8592
Lastline DarkHotel Just In Time Decryption Nov 2015ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1330d8a5-c8be-4579-8a91-4cfda860ea0a
Securelist Darkhotel Aug 2015 · Microsoft DUBNIUM July 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e05bf60-ac1b-4497-a9bc-55eff65cf927
Microsoft DUBNIUM July 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27b05a62-5310-40d9-9e49-b4dce3afad55
Kaspersky DarkhotelATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c44970b-616d-401e-b9ed-72ac39ca5709
Securelist Darkhotel Aug 2015 · Microsoft DUBNIUM July 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37c94531-1e56-4640-93fd-e9fd65da4f80
Kaspersky DarkhotelATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cce0cb1-051f-48da-8712-e9d2eba871a0
Securelist Darkhotel Aug 2015 · Microsoft DUBNIUM July 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48649215-087c-4ded-925c-f2c3f57dcba1
Securelist Darkhotel Aug 2015ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b3f0b38-d4e2-49e8-a8f9-6a186c31967f
Securelist Darkhotel Aug 2015 · Microsoft DUBNIUM July 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f62c818-2129-4dc2-9f80-105412df4b1d
Kaspersky DarkhotelATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1091
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bad7b38-36b5-4208-9895-e4a113c511a3
Kaspersky DarkhotelATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cc93842-6c19-4d5c-8e9b-81dfa58e859e
Lastline DarkHotel Just In Time Decryption Nov 2015ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8395d178-d5e8-494f-8612-3c2542b2f8c9
Lastline DarkHotel Just In Time Decryption Nov 2015 · Microsoft DUBNIUM June 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9158696f-fdc6-4869-a395-5d94c7c13d26
Lastline DarkHotel Just In Time Decryption Nov 2015ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b69424ec-3af6-44aa-842a-81fba219b9f4
Kaspersky Darkhotel · Securelist Darkhotel Aug 2015ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba18af0c-8b4d-4be0-9b62-f29207856ea9
Securelist Darkhotel Aug 2015 · Microsoft DUBNIUM July 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bfc84868-c168-4db4-be39-641cfab0619a
Microsoft DUBNIUM July 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4995d4f-2b7e-439f-afb1-a4c9218c7a08
Securelist Darkhotel Aug 2015ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5fd969c-7fda-4f3a-9f54-1f1455f14956
Microsoft DUBNIUM June 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cdfe5f64-0a34-483c-b921-feaf18357354
Microsoft DUBNIUM June 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d021d378-a5ff-4020-972c-cc9152e824b0
Kaspersky DarkhotelATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1bcdc6c-771a-4606-b7f4-cdfbef5efc34
Microsoft DUBNIUM June 2016ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e936d8c6-f069-49b1-8d4e-9ecafab2a576
Securelist Darkhotel Aug 2015 · Microsoft DUBNIUM July 2016