Check out the whitepaper they published along with the article. It goes into more detail about the attacks. It appears they have a record of the traffic from th

Check out the whitepaper they published along with the article. It goes into more detail about the attacks. It appears they have a record of the traffic from the hotels' networks, probably from an IDS or something similar. Some relevant quotes from the whitepaper: "The Darkhotel APT’s precise malware spread was observed in several hotels’ networks, where visitors connecting to the hotel’s Wi-Fi were prompted to install software updates to popular software packages." - page 5 "As a part of an ongoing investigation, our research led us to embedded iframes within hotel networks that redirected individuals’ web browsers to phony installers. The attackers were very careful with the placement of these iframes and executables on trusted resources - the hotels’ network login portals themselves." - page 6 "We observed traces of a couple of these incidents in late 2013 and early 2014 on a victim hotel’s network. The attackers set up the environment and hit their individual targets with precision. As soon as their target’s stay was over and the attack-frame was closed, the attackers deleted their iframe placement and backdoored executables from the hotel network." - page 6