The Darkhotel APT • Hacker News Board

Re: The Darkhotel APT

#11

Post by tkmcc » Mon, Nov 10, 2014, 8:39 PM UTC

Interesting bits from the Technical Appendix:

- If the Information Stealer detects that the current system default codepage is 0412 (Korean) it terminates.

- Also regarding the Information Stealer: "If the server reply contains a keyword «minmei» it continues sending additional information. «Minmei» may be a reference to a popular Japanese anime and manga known as «The Super Dimension Fortress Macross»."

- The Enhanced Keylogger's debug info path was left compiled into the binary: "d:\KerKey\KerKey(일반)\KerKey\release\KerKey.pdb" (note 일반 means "General" in Korean).

I'm unsure whether this is intentional misdirection or simply due to bad OPSEC, but this kind of stuff sticks out because it indicates a fairly large-scale and international APT campaign may be coming out of somewhere in Asia besides China.

Re: The Darkhotel APT

#12

Post by pavel_lishin » Mon, Nov 10, 2014, 10:53 PM UTC

internet_arguer wrote: post #9

pavel_lishin wrote: post #7

Earlier quoted context omitted.

> Kaspersky performs good malware campaign analysis without sensationalism. Did you play the video?

No, was it sensationalized? Dammit. I never watch the videos on news sites. Too disruptive for my work environment.

It's a wise policy.

Re: The Darkhotel APT

#13

Post by Estragon » Tue, Nov 11, 2014, 7:23 AM UTC

amckenna wrote: post #10

Estragon wrote: post #5

Why should we believe this? They admit that they have been unable to find any "dark hotel" infrastructure. What is the basis for their claim that the attacks take place in hotels?

Check out the whitepaper they published along with the article. It goes into more detail about the attacks. It appears they have a record of the traffic from the hotels' networks, probably from an IDS or something similar. Some relevant quotes from the whitepaper: "The Darkhotel APT’s precise malware spread was observed in several hotels’ networks, where visitors connecting to the hotel’s Wi-Fi were prompted to insta…

Thank you.