Kaspersky Lab sheds light on Darkhotels

KASPERSKY Labs Global Research and Analysis Team experts researched the Darkhotel espionage campaign, which has lurked in the shadows for at least four years while stealing sensitive data from selected corporate executives travelling abroad.

Darkhotel hits its targets while they are staying in luxury hotels. The crew never goes after the same target twice.

They perform operations with surgical precision, getting all the valuable data they can from the first contact, deleting traces of their work and melting into the background to await the next high profile individual.

The most recent travelling targets include top executives from the US and Asia doing business and investing in the APAC region: CEOs, senior vice presidents, sales and marketing directors and top R&D staff have all been targeted.

Who will be next? This threat actor is still active, Kaspersky Lab warns.

How the hotel attack works

The Darkhotel actor maintains an effective intrusion set on hotel networks, providing ample access over the years, even to systems that were believed to be private and secure.

They wait until, after check-in, the victim connects to the hotel Wi-Fi network, submitting his room number and surname at the login.

The attackers see him in the compromised network and trick him into downloading and installing a backdoor that pretends to be an update for legitimate software - Google Toolbar, Adobe Flash or Windows Messenger.

The unsuspecting executive downloads this hotel welcome package, only to infect his machine with a backdoor, Darkhotels spying software.

Read more here:
Kaspersky Lab sheds light on Darkhotels