DarkHotel__2021__New_DarkHotel_APT_attack_chain_identified_Zscaler.pdf

Executive summary: Zscaler ThreatLabz identified a previously undocumented DarkHotel APT attack chain (Nov 2021) that leverages a multi-layered DOCX/RTF with embedded OLE objects to drop and execute a scriptlet (googleofficechk.sct), which installs qq3104.exe and qq2688.exe, creates a persistent Windows service that runs encoded PowerShell to load an in-memory .NET downloader, and communicates with active C2 domains; the report provides technical analysis, IOCs (MD5, C2 domains/URLs, file and registry artifacts), and evidence of related phishing domains used to harvest cryptocurrency wallet credentials.