DarkHotel

Profile narrative

DarkHotel, also tracked as APT‑C‑06, is a threat actor that has been active since at least 2007 and is known by the aliases DarkHotel and APT‑C‑06. Public reporting indicates the actor may be based in Romania, though this location is not definitively confirmed in open sources. The group is described as conducting cyber‑espionage operations, with a focus on gathering sensitive information from targeted victims over an extended period.

The actor’s typical targets include government employees and business executives, particularly in the sectors of government, healthcare, and humanitarian organizations. Geographically, DarkHotel’s operations have been traced to East Asia, with specific victims reported in China, North Korea, Japan, and the United States. The strategic objective behind these activities is espionage, as the group seeks to obtain data that could be valuable to intelligence efforts, such as information related to public health crises or regional affairs.

Notable tactics observed in public reports involve the use of malicious websites that mimic legitimate internal email systems to harvest credentials, a technique seen in the attempted intrusion against the World Health Organization in March 2020 where a spoofed WHO login page was deployed. The actor relies on phishing‑style initial access and has been associated with specific web infrastructure that has also been used against other healthcare and humanitarian targets. While some researchers have noted connections to East Asian infrastructure, no public source has definitively attributed DarkHotel to a state sponsor or criminal consortium, leaving its affiliations uncertain in the open‑source record. Reporting continues to highlight the group’s persistent use of credential‑stealing web pages as a hallmark of its operational style.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 0 sources.