Friday, March 29, 2024

RevengeHotels – Malware Attack Via Weaponized Word Documents to Steal Users Credit Card Data

A new malware campaign dubbed “RevengeHotels” targeting hotels, hostels, hospitality, and tourism companies worldwide aimed to steal credit card data of users and Travelers from hotel management systems.

The campaign uses email as the main attack vector to deliver malware via weaponized Word, Excel or PDF documents. In some cases, it exploits patched Remote Code Execution Vulnerability CVE-2017-0199 in Microsoft Office or WordPad.

Researchers from Kaspersky observed tow hacking groups ProCC and RevengeHotels targeting the hospitality sector and they found to be active at least from 2015.

Tactics Used – RevengeHotels

Threat actors use to register typo-squatting domains impersonating the legitimate company names to trick the user believing the email is from the legitimate source.

They use to send emails with details for booking hotels and the spear-phishing email written in the Portuguese language with the malicious file named Reserva Advogados Associados(.)Docx (Attorneys Associates Reservation(.)Docx) attached.

revengehotels
Spear-phishing Email

When the user opens the attached malicious Word document, it drops a remote OLE(Object Linking and Embedding) object via template injection technique to execute the macro that presents inside OLE.

The macro that presents inside contains a PowerShell code that downloads the final payload. The final payload in one such example is a RevengeRAT, the threats include an additional module called ScreenBooking to steal credit card details.

When compared to RevengeHotels campaigns the malware used in ProCC campaigns are highly customized, the malware used is capable of collecting details from clipboard and printer spooler, and capture screenshots.

Data Sold on Underground Forums

The cybercriminals also sell the stolen customer credit card details on dark webs and also access to hotels.

“These criminals also infect front desk machines to capture credentials from the hotel administration software; they can then steal credit card details from it too,” reads the Kaspersky blog post.

Researchers believe the attack has global reach and victims confirmed in the following countries.

revengehotels
Affected Victim’s location

The campaign used customized versions of RevengeRAT, NjRAT, NanoCoreRAT, 888 RAT and a custom malware ProCC to compromise victim machines.

As the holiday season progresses attacks targeting the hospitality sector or on the rise, users can alternatively use virtual payment cards or wallets to stay safe.

IoCs

74440d5d0e6ae9b9a03d06dd61718f66
e675bdf6557350a02f15c14f386fcc47
df632e25c32e8f8ad75ed3c50dd1cd47
a089efd7dd9180f9b726594bb6cf81ae
81701c891a1766c51c74bcfaf285854b

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles