Darkhotel

Overview

Executive Summary

Infection Vector and Technical Capabilities

• Digital Signature Abuse: The malware is almost always signed with legitimate, though stolen, digital certificates to bypass strict application whitelisting and EDR solutions that trust signed binaries.
• Targeted Espionage: The core payload is a sophisticated information stealer and keylogger. It is designed to harvest cached passwords in major browsers, steal SSH keys, intercept VoIP communications, and silently exfiltrate sensitive intellectual property.
• Selective Execution: The malware often checks the system language and specific environmental variables; if the target does not match the precise profile the attackers are seeking, the malware may safely delete itself to avoid detection by security researchers.

Threat Assessment

Incident Response and Remediation

• Full APT IR Protocol: Standard remediation is insufficient. The presence of Darkhotel requires the activation of a specialized Incident Response team to conduct a comprehensive network hunt, assuming the attackers have established multiple layers of persistence (including backdoored firmware).
• Forensic Capture: Do not immediately wipe the machine. Capture full volatile memory (RAM) and disk images to reverse engineer the specific, bespoke payload deployed against the target to understand what data was targeted.
• Travel Security Policy Revision: The hallmark of this attack vector requires a fundamental shift in corporate travel security. Executives traveling to high-risk regions must utilize dedicated "burner" laptops with strict VPN tunneling policies and must never accept software updates over public or hotel Wi-Fi networks.

Known aliases

Threat reports may refer to this family under multiple names:

• APT.Darkhotel
• Trojan.Darkhotel
• Tapaoux

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1189 T1116 T1056 T1555

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DARKHOTEL {
    meta:
        description = "Detects Darkhotel (backdoor)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "darkhotel" ascii wide nocase
        $s2 = "apt.darkhotel" ascii wide nocase
        $s3 = "trojan.darkhotel" ascii wide nocase
        $s4 = "tapaoux" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Darkhotel Activity
id: 50487f1e0738711f48532222828e89d4
status: experimental
description: Detects generic indicators of the darkhotel malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*darkhotel*"
            - "*apt.darkhotel*"
            - "*trojan.darkhotel*"
            - "*tapaoux*"
    condition: selection
level: medium

References & External Analysis

• Search "darkhotel" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: backdoor)

Explore other malware families in the same category:

• Agobot
• Rbot
• Doublefantasy
• Hacdef
• Teamspy

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/darkhotel.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.