DarkHotel is a threat actor attributed to KR, also known as TUNGSTEN BRIDGE, Zigzag Hail, Nemim. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does DarkHotel exploit?

DarkHotel is known to exploit 4 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

DarkHotel

Also known as: TUNGSTEN BRIDGE, Zigzag Hail, Nemim, Tapaoux, DUBNIUM, Purple Pygmy, Shadow Crane, G0012, Pioneer, G0126, T-APT-02, CTG-1948, ATK52, Tungsten Bridge, SIG25, Dark Hotel, Higaisa, Luder, APT-C-06, Fallout Team, Nemin, ATK 52, Karba, Dubnium, TieOnJoe, TEMPLAR, Egobot, PALADIN, APT-C-60, APT-Q-12

KRInformation theft and espionage

Exploited CVEs

Overview

Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crews most unusual characteristic is that for several years the Darkhotel APT has maintained a capability to use hotel networks to follow and hit selected targets as they travel around the world.'

Exploited Vulnerabilities

CVE ID	Action
CVE-2018-8174