Threat Group Ramps-Up Attacks on Hospitality, Travel Sectors in 2022

guest · Aug 18, 2022

August 18, 2022

Researchers have revealed new details of a prolific APT group which has used 15 malware families over the past four years to steal data from travel and hospitality companies.

Financially motivated, group TA558 targets mainly organizations in Latin America and sometimes North America and Western Europe, switching between Portuguese, Spanish and English as it does so, according to Proofpoint.
Click to expand...

It primarily uses phishing emails as its access vector, deploying reservation-themed lures with content relevant to the victim organization such as hotel room bookings.

These emails contain either malicious links or attachments designed to covertly install malware, which will then enable reconnaissance, data theft and the download of additional payloads, the report explained.
Among the multiple malware types used by the group are Loda RAT, Vjw0rm, Revenge RAT and AsyncRAT.
Click to expand...

TA558 uses its own infrastructure most of the time, although Proofpoint has seen it leverage compromised hotel websites to host malicious payloads in a bid to fly under the radar of security monitoring tools.

Although the group has been operational since 2018, they have “significantly” increased their campaign tempo in 2022, Proofpoint warned.

“Additionally, TA558 began using URLs more frequently in 2022. TA558 conducted 27 campaigns with URLs in 2022, compared to just five campaigns total from 2018 through 2021. Typically, URLs led to container files such as ISOs or zip files containing executables,” the report noted.
“The malware used by TA558 can steal data including hotel customer user and credit card data, allow lateral movement, and deliver follow-on payloads.”
Click to expand...

Proofpoint: Reservations Requested: TA558 Targets Hospitality and Travel

Key Findings:

TA558 is a likely financially motivated small crime threat actor targeting hospitality, hotel, and travel organizations.

Since 2018, this group has used consistent tactics, techniques, and procedures to attempt to install a variety of malware including Loda RAT, Vjw0rm, and Revenge RAT.

TA558’s targeting focus is mainly on Portuguese and Spanish speakers, typically located in the Latin America region, with additional targeting observed in Western Europe and North America.

TA558 increased operational tempo in 2022 to a higher average than previously observed.

Like other threat actors in 2022, TA558 pivoted away from using macro-enabled documents in campaigns and adopted new tactics, techniques, and procedures.

Click to expand...

Log in or Sign up

Threat Group Ramps-Up Attacks on Hospitality, Travel Sectors in 2022

guest Guest

Log in or Sign up

Threat Group Ramps-Up Attacks on Hospitality, Travel Sectors in 2022

guest Guest

Useful Searches