Hackers classified as TA558 have been increasing their activities since the beginning of this year. There has been an increase in the number of phishing campaigns run by the TA558 group and targeting a range of hotels and travel companies.

Threat actors make use of an assortment of 15 distinct malware families, mostly RATs, which are intended to do the following:- 

• Gain access to the target systems
• Conduct surveillance on a regular basis
• Theft of key data
• Scamming customers out of their money

Proofpoint has recently seen an increase in the number of attacks associated with TA558 which has been active since at least 2018. It is likely that tourism has recovered after the COVID-19 restrictions were imposed for two years.

Campaigns Targeting Hotel & Travel Organizations

TA558 began using RAR and ISO file attachments in its phishing emails in the year 2022, instead of macro-laced documents in the messages. TA558 also embedded URLs in the messages in place of attachments.

Microsoft’s decision to block VBA and XL4 macros in Office has prompted similar changes to be seen with other threat actors as well. It has traditionally been used by hackers for the following purposes:-

• Loading malware
• Dropping malware
• Installing malware

There are three languages, English, Spanish, and Portuguese, used in phishing emails that start the infection chain. 

The majority of their targets are located in the following countries:- 

• North America
• Western Europe
• Latin America

In the emails, the main topic is to make a reservation at the organization that is targeted. Emails of this type are sent under the pretense of coming from reputable sources like conference organizers and tourist office agents which are hard for the recipients to disregard.

An ISO file will be received from a remote resource if the victim clicks on the URL in the message body. The URL in the message claims to be the reservation link and is supposedly attached to the message.

There is a batch file inside the archive that pitches a PowerShell script when it’s executed. A scheduled task is created by the script to keep the RAT payload on the victim’s computer as long as the script is running.

It involved downloading a follow-on payload, AsyncRAT, in the server for execution from a PowerShell script after executing the BAT file.

This year in most cases, the threat actors have used the following payload:-

• AsyncRAT or Loda

While on a small scale, the threat actors have used the following payloads:-

• Revenge RAT
• XtremeRAT
• CaptureTela
• BluStealer

In most of the cases Proofpoint observed this year, the payload was AsyncRAT or Loda, while Revenge RAT, XtremeRAT, CaptureTela, and BluStealer were also deployed on a smaller scale.

Instead of using room reservations as a lure for a 2022 campaign, one campaign used QuickBooks invoices. The RAT malware compromises the hotel’s systems, so TA558 enters the network deeper and steals sensitive information like:-

• Customer PII
• Stored credit card details
• Stored debit card details
• Divert reservation payments

A hack of the Booking.com account of The Marino Boutique Hotel in Lisbon, Portugal, was detected in July 2022. It took the hacker only four days to steal a hefty €500,000 through the hacked account of the hotel.

Also Read: The Rise of Remote Workers: A Checklist for Securing Your Network – Free E-Book Download