DarkHotel__2014__darkhotel_kl_07.11.pdf

Kaspersky's November 2014 report analyzes the Darkhotel APT: a long‑running, highly targeted espionage operation that compromises hotel and business‑center networks and seeds p2p torrents to deliver digitally signed backdoors, kernel‑level keyloggers and information‑stealers; the group uses spear‑phishing with 0‑day Flash/IE exploits, fraudulent or stolen certificates, and a global C2 infrastructure, and the report provides technical indicators, malware breakdowns, sinkhole/C2 data and victim distribution to aid detection and response.