Kaspersky Lab security researchers have identified an active threat that is exploiting compromised hotel networks, targeting high-profile figures and top business executives. The campaign dates back to 2010, but some of the hacking tools used to this day date back to 2007.
Also known as Darkhotel, the sophisticated espionage campaign is well-funded, and in order to achieve its goals it uses zero-day exploits in Internet Explorer and Adobe, even at the risk of being discovered, Kaspersky researchers found.
The victims of this campaign include CEOs, executive vice presidents, marketing directors, sales directors and top executives in the research and development sector of businesses operating or outsourcing in the Asia-Pacific region (APAC).
These executives are associated with electronics and pharmaceutical industries, investment companies, automobile manufacturers, as well as various non-governmental organizations.
The actors behind Darkhotel, or Tapaoux, are particularly careful in choosing their victims and act by delivering malware disguised as software updates, which are distributed through the networks of the hotels hosting each target.
“This group of attackers appears to know in advance the exact arrival and departure dates of victims at high-end hotels. Thus, the attackers simply wait for the travelers to arrive and connect to the Internet,” Kaspersky said in a report published on Monday.
When potential victims connect to Wi-Fi , a pop-up appears asking them to download an update for popular software, such as Google Toolbar, Adobe Flash, or Windows Messenger. Accepting any “update,” however, can only lead to infection and data theft from their devices.
