Darkhotel APT Malware Targets Global CEOs Using Hotel Internet

November 11, 2014 – 7:34 AM

A seven-year-old cyber espionage campaign has targeted senior level executives from large global companies by using a specialized Advanced Persistent Threat (APT), zero-day exploits, and well-developed keyloggers to extract information from them when they stay in luxury hotels during their business trips.

The researchers at Moscow-based security firm Kaspersky Lab dubbed the threat as “DarkHotel APT,” appear to have the ability to know in advance when a targeted executive checks in and checks out of a hotel.

The group has been operating in Asia since from 2009 but there have been infections recorded in the United States, South Korea, Singapore, Germany, Ireland and many others, as well. It uses hotel Wi-Fi networks to target elite executives at organisations in manufacturing, defense, investment capital, private equity, automotive and other industries.

The group has access to zero day vulnerabilities and exploits, and it used them to infect victims. Threat actors use three different malware distribution methods including malicious Wi-Fi networks, booby-trapped P2P torrents, and highly customized spear phishing, Kaspersky Lab reported in research paper.

When the target executives connect their devices to the hotel’s Wi-Fi or wired Internet access, they are shown bogus software updates, typically something that looks legitimate, for Adobe Flash, Google Toolbar, or Windows Messenger. But these updates also contain a type of malware called a Trojan dropper bundled with more malware.

Source:
http://thehackernews.com/2014/11/darkhotel-apt-malware-targets-global.html