Cyber Incident Victim: Marriott International
Date:
Jan 2018
Location:
Germany
Summary
Marriott was among multiple international companies compromised by the Winnti malware, linked to a Chinese state-aligned hacking group specializing in corporate espionage. The attackers gained initial access through phishing emails, often targeting human resources personnel with malicious links disguised as job applicant materials. Once inside networks, the malware enabled prolonged unauthorized access, allowing the group to stealthily map infrastructure, modify commonly used programs, and exfiltrate sensitive data over extended periods. The campaign impacted organizations across various sectors, including hospitality, healthcare, and manufacturing, with a notable concentration in Germany. While some victims detected the intrusion early, others experienced sustained breaches, highlighting the malware's effectiveness in maintaining persistence for data theft.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The Winnti malware attack impacting Marriott International was part of a broader campaign targeting multinational corporations beginning as early as 2018. According to investigations by German media outlets BR and NDR, the attackers compromised Marriott's systems using Winnti malware—a trojan associated with Chinese state-sponsored hacking groups active since 2009. The initial intrusion vector involved phishing emails directed at human resources personnel and recruiters, impersonating job applicants with malicious links leading to malware installation. Once inside Marriott's network, the attackers employed a "low and slow" operational strategy, methodically mapping infrastructure and injecting malicious code into widely used company applications to maintain persistent access. This allowed prolonged data exfiltration without immediate detection.
The malware's presence on corporate systems was first identified in April 2018 by German pharmaceutical company Bayer, which traced the intrusion to Chinese actors and alerted other organizations. Subsequent analysis revealed Winnti had compromised at least a dozen major firms, including Marriott, BASF, Siemens, Roche, and Valve. While Bayer successfully contained the threat before data theft occurred, the full extent of Marriott's data exposure remains unclear. The attackers targeted both Windows and Linux systems, leveraging Winnti's signature remote administration capabilities to extract sensitive corporate information over extended periods. German investigators noted the campaign's unprecedented scale, with an unnamed official describing the number of compromised organizations as "mind-boggling." The incident underscored systemic vulnerabilities in corporate cybersecurity practices, particularly regarding phishing susceptibility and network monitoring gaps.