APT Activity Detected Targeting Luxury Hotels in China,says Trellix

Sharing insights from the Trellix Threat Research team about a recently detected APT malicious campaign by DarkHotel targeting luxury hotels.

a South Korean-based group, used spyware and malware to attack visitors using a hotel’s in-house Wi-Fi network and typically target high-profile executives in financial services, government, development and defence industries. Their most recently detected efforts occurred in China in November 2021 using a spear phishing email directed at hotel management to gain access to guest information.

This activity underscores the vulnerabilities that even the hospitality industry faces globally. Bad actors targeting high-value hotel guests by compromising hotel networks before or during a conference is a proven espionage method.

“Campaigns such as these are not exclusive to any one global region, and we know that there can be an uptick in advanced persistent threats (APT) especially during times of turmoil and instability. DarkHotel, and groups similar, have a lot to gain by targeting high-level individuals as a means of easy access to troves of data and information. They have been diligent in their attacks for the better half of the past decade exploiting victims across industries, sectors and geos making them an elite hacking group to be vigilant of,” says John Fokker, Head of Cyber Investigations at Trellix.

The full findings can be found here - Suspected DarkHotel APT activity update. Happy to coordinate a follow-up interview with John Fokker if that would be of value as well.

Trellix At A Glance

Trellix is a pure play cybersecurity company creating a resilient digital world that enables trust and success for all. The company’s market-leading XDR ecosystem learns and adapts through a living security platform built to disrupt active threats. Along with actionable intelligence gleaned from Threat Labs researchers, Trellix empowers over 40,000 business and government customers to build confidence by embedding security into their DNA. Trellix has 5,000 employees and nearly $2B of revenue.