A Phishing Campaign Targeting Hotels and Travel Companies Detected

A phishing campaign against hotels and travel companies is attributed by Infosecurity Magazine to TA558, a group active in the hospitality and travel sector since 2018. The e-mails, in English, Spanish and Portuguese, ask the target to make a reservation. A link then delivers an ISO file that starts a script and installs remote access malware, mostly AsyncRAT.

What is the TA558 phishing campaign against hotels?

A phishing campaign targeting multiple hotels and travel companies has been detected running by the TA558 group. In the campaign, it was observed that RAT malware was exploited, allowing threat actors to access targeted systems, monitor the system regularly, capture critical data and carry out fraudulent activities with the captured data. In addition, it is seen that RAR and ISO file attachments have started to be used in this campaign instead of macro-content documents sent by phishing e-mails.

How does the phishing campaign start?

The chain of infection starts with the sending of phishing e-mails with message text in English, Spanish and Portuguese to the associated destinations. The main topic covered in the e-mails is to make a reservation at the targeted establishment. Such e-mails are sent purporting to come from key sources such as conference organizers and tourist office agents that are hard for recipients to ignore.

What happens after the ISO file opens?

An ISO file from a remote source is uploaded to the target system when targets click on the URL claimed to be the reservation link in the message body. The ISO file contains a BAT file (batch file) that will run a PowerShell script when executed. In order to ensure permanence, the script creates a scheduled task to hold the RAT load on the target computer as long as the script is running. By executing the BAT file and then the PowerShell script, target systems are injected with malware such as AsyncRAT (mostly), Loda, Revenge RAT, XtremeRAT, CaptureTela, and BluStealer. RAT malware endangers hotel systems and causes the identity information of customers, bank, and credit card data being stored to be captured by threat actors.

Who is TA558 and how can hotels protect themselves?

TA558 has been an active threat actor targeting the hospitality, travel, and related industries since 2018. The activities carried out by this actor lead to the capture of corporate and customer data and possible financial losses. In this context, it is recommended to consider the following security practices to avoid being the target of similar attack campaigns.

• E-mails, attachments, and links from unknown, suspicious parties should not be respected.
• File/Program or application downloads should be made from legitimate and reliable sources.
• Comprehensive Anti-Virus/Anti-Malware security solutions should be used.
• Institution/organization personnel should be made aware of potential phishing/social engineering attacks.
• IOC findings related to the campaign should be blocked from security solutions.