TA558: AI-Powered Attacks Target Hospitality Sector

A persistent cybercriminal group tracked as TA558, also known by aliases such as RevengeHotels, has been actively targeting hospitality, hotel, and travel organizations since at least 2015. This group, primarily financially motivated, has evolved its tactics, techniques, and procedures (TTPs) to include advanced methods like AI-generated scripts and steganography to deliver a wide array of Remote Access Trojans (RATs) and info-stealers. Their main objective is the exfiltration of sensitive data, particularly credit card information from guests and travelers stored in hotel systems and online travel agencies.

TA558’s operations are geographically diverse, focusing heavily on Portuguese and Spanish-speaking regions in Latin America, but with observed activity extending to Western Europe, North America, Russia, Romania, and Turkey.

Infection Method

TA558 typically initiates its attacks through highly convincing phishing emails. These emails often masquerade as legitimate communications, such as invoices, booking confirmations, or job applications, and are written in Portuguese or Spanish to target their primary victim base.

The infection chain involves several stages:

Initial Access: Phishing emails contain malicious attachments (e.g., word processing, spreadsheet, presentation, PDF documents) or fraudulent links. These attachments often exploit common vulnerabilities in widely used office productivity suites, such as those related to equation editors (CVE-2017-11882) or other remote code execution flaws (CVE-2017-8570 and CVE-2017-0199).
Payload Delivery: Upon execution, the malicious documents leverage macros, JavaScript loaders, or PowerShell downloaders to retrieve subsequent stages of the malware. Recent campaigns have been observed using AI-generated scripts for these initial infectors and downloaders, indicating a new trend in their tradecraft.
Obfuscation and Staging: TA558 employs sophisticated obfuscation techniques, including steganography, to embed malicious Visual Basic Scripts (VBSs), PowerShell code, or RTF documents within seemingly innocuous images and text files. These files are then downloaded from external URLs or free text-sharing websites.
Malware Deployment: The final stage involves the execution of a wide range of RATs and info-stealers, establishing long-term presence and control over the compromised system.

Malware Behavior and Capabilities

TA558 deploys a diverse portfolio of malware, including Loda RAT, Revenge RAT, vjw0rm, njRAT, AsyncRAT, Ozone RAT, Agent Tesla, FormBook, Remcos RAT, LokiBot, GuLoader, Snake Keylogger, XWorm, Venom RAT, NanoCoreRAT, 888 RAT, and custom malware like ProCC. These malware families exhibit extensive capabilities typical of espionage-grade tools:

Remote Access and Control: Establishes interactive command and control (C2) channels, allowing attackers to execute arbitrary commands.
Data Exfiltration: Capable of stealing cached credentials, authentication tokens, credit card data, and other sensitive information from compromised systems.
Keylogging and Screen Capturing: Records keystrokes and captures screenshots to gather sensitive input and visual data.
Persistence Mechanisms: Achieves persistence through various methods, including modifying operating system registry run-keys, tampering with task scheduler, and setting processes as critical system processes to resist termination.
Anti-Analysis and Anti-Kill Features: Some malware, like Venom RAT, includes anti-kill protection mechanisms, modifying Discretionary Access Control Lists (DACL) and terminating security analysis tools to ensure uninterrupted operation.
Lateral Movement and Propagation: Some malware, like Venom RAT, incorporates capabilities to spread via removable USB drives.
Evasion of Security Controls: Employs obfuscation (e.g., Base64 encoding, steganography) and can attempt to disable or interfere with common antivirus software.
Reverse Proxy Capabilities: Utilizes infected hosts as SOCKS5 proxies for covert communication.

Tactics, Techniques, and Procedures (TTPs)

TA558’s operations map to several MITRE ATT&CK techniques, highlighting their systematic approach:

Initial Access: T1566 – Phishing (Spearphishing Attachment, Spearphishing Link).
Execution: T1203 – Exploitation for Client Execution (CVE-2017-11882, CVE-2017-0199, CVE-2017-8570), T1059 – Command and Scripting Interpreter (PowerShell, VBScript, JavaScript).
Persistence: T1547 – Boot or Logon Autostart Execution (Registry Run Keys/Startup Folder).
Defense Evasion: T1027.003 – Steganography, T1562 – Impair Defenses (Disable or Modify Tools).
Command & Control / Lateral or Additional Payload Delivery: T1105 – Ingress Tool Transfer. Downloading additional payloads (RATs, loaders, utility binaries) from attacker-controlled hosts or cloud links to the victim environment.

Affected Products

Organizations using the following are particularly vulnerable if proper patching and security measures are not in place:

Commonly used office productivity suites (word processing, spreadsheet, presentation) that are unpatched against CVE-2017-11882, CVE-2017-8570, and CVE-2017-0199.
Windows operating systems, especially those where malware can establish persistence and disable security features.
Systems handling credit card data in the hospitality, travel, industrial, services, public, electric power, and construction sectors.

Impact and Exploit Potential

Successful exploitation by TA558 can lead to severe consequences for targeted organizations:

Financial Losses: Direct theft of credit card data from guests and travelers, leading to fraud and potential regulatory fines.
Reputational Damage: Erosion of trust among customers due to data breaches.
Corporate Data Theft: Exfiltration of sensitive corporate data, intellectual property, or business intelligence.
Persistent Access: Long-term unauthorized access to enterprise environments, enabling ongoing surveillance and data harvesting.
System Compromise: Full remote control over infected systems, potentially leading to further network compromise.
Evasion of Traditional Security Controls: Sophisticated obfuscation and anti-analysis techniques make detection challenging.

Mitigation Strategies

Organizations, particularly those in the hospitality and travel sectors, must implement robust security measures to reduce exposure to TA558’s attacks:

Patch and Update Software: Regularly apply relevant security patches for all operating systems and software, especially widely used office productivity suites, to remediate known vulnerabilities like CVE-2017-11882, CVE-2017-8570, and CVE-2017-0199.
Email Security Gateways: Implement advanced email security solutions to filter out malicious phishing emails, attachments, and links before they reach end-users.
Endpoint Detection and Response (EDR): Deploy EDR solutions to monitor for suspicious activities, detect malware behavior, and facilitate rapid response to incidents.
Security Awareness Training: Educate employees about the dangers of phishing, social engineering, and the importance of verifying sender identities and scrutinizing suspicious attachments or links.
Disable Macros by Default: Configure common office productivity suites to disable macros by default and warn users before enabling them. Provide clear guidance on when and how to safely enable macros.
Network Segmentation: Implement network segmentation to limit lateral movement within the network in case of a breach.
Data Loss Prevention (DLP): Deploy DLP solutions to prevent unauthorized exfiltration of sensitive data, such as credit card information.
Monitor for IOCs: Stay updated with threat intelligence from reputable sources regarding TA558’s latest indicators of compromise (IOCs), including C2 domains and malware hashes.
Regular Backups: Maintain regular, secure backups of critical data to ensure business continuity in the event of a successful attack.
Application Control: Implement application control to prevent the execution of unauthorized or suspicious executables and scripts.
Browser Security: Use secure enterprise browsers to protect against browser-based threats and enforce security policies.

Instantly Fix Risks with Saner Patch Management

Saner Patch Management is a continuous, automated, and integrated software solution designed to proactively address vulnerabilities and instantly fix risks exploited in the wild. The software supports major operating systems like Windows, Linux, macOS, and over 550 third-party applications.

It also facilitates setting up a secure testing environment to validate patches before their broad deployment in a primary production environment. Additionally, Saner Patch Management includes a patch rollback feature, offering a safety net in case of patch failure or system malfunction.

Experience the fastest and most accurate patching software here.