Hackers classified as TA558 have been increasing their activities since the beginning of this year. There has been an increase in the number of phishing campaigns run by the TA558 group and targeting a range of hotels and travel companies.
Threat actors make use of an assortment of 15 distinct malware families, mostly RATs, which are intended to do the following:-
Proofpoint has recently seen an increase in the number of attacks associated with TA558 which has been active since at least 2018. It is likely that tourism has recovered after the COVID-19 restrictions were imposed for two years.
TA558 began using RAR and ISO file attachments in its phishing emails in the year 2022, instead of macro-laced documents in the messages. TA558 also embedded URLs in the messages in place of attachments.
Microsoft’s decision to block VBA and XL4 macros in Office has prompted similar changes to be seen with other threat actors as well. It has traditionally been used by hackers for the following purposes:-
There are three languages, English, Spanish, and Portuguese, used in phishing emails that start the infection chain.
The majority of their targets are located in the following countries:-
In the emails, the main topic is to make a reservation at the organization that is targeted. Emails of this type are sent under the pretense of coming from reputable sources like conference organizers and tourist office agents which are hard for the recipients to disregard.
An ISO file will be received from a remote resource if the victim clicks on the URL in the message body. The URL in the message claims to be the reservation link and is supposedly attached to the message.
There is a batch file inside the archive that pitches a PowerShell script when it’s executed. A scheduled task is created by the script to keep the RAT payload on the victim’s computer as long as the script is running.
It involved downloading a follow-on payload, AsyncRAT, in the server for execution from a PowerShell script after executing the BAT file.
This year in most cases, the threat actors have used the following payload:-
While on a small scale, the threat actors have used the following payloads:-
In most of the cases Proofpoint observed this year, the payload was AsyncRAT or Loda, while Revenge RAT, XtremeRAT, CaptureTela, and BluStealer were also deployed on a smaller scale.
Instead of using room reservations as a lure for a 2022 campaign, one campaign used QuickBooks invoices. The RAT malware compromises the hotel’s systems, so TA558 enters the network deeper and steals sensitive information like:-
A hack of the Booking.com account of The Marino Boutique Hotel in Lisbon, Portugal, was detected in July 2022. It took the hacker only four days to steal a hefty €500,000 through the hacked account of the hotel.
Also Read: The Rise of Remote Workers: A Checklist for Securing Your Network – Free E-Book Download
The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese…
Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in…
The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against…
Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to…
A security researcher discovered a vulnerability in Windows theme files in the previous year, which…
The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to…