Cataloged
IdentityTracking identifier: G0012
Reviewed identity mapping approved on this date.
Darkhotel
Also known as DUBNIUM, Zigzag Hail
Tracked as
G0012
Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
IdentityAlias: DUBNIUM
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Zigzag Hail
Reviewed identity mapping approved on this date.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
DarkhotelCanonical Name
DUBNIUMAlias
Zigzag HailAlias
G0012Tracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...