Reservations Requested: TA558 Targets Hospitality and Travel

Since 2018, security researchers tracked a financially-motivated cybercrime actor, TA558, targeting hospitality, travel, and related industries located in Latin America and sometimes North America, and western Europe. The actor sends malicious emails written in Portuguese, Spanish, and sometimes English. The emails use reservation-themed lures with business-relevant themes such as hotel room bookings. The emails may contain malicious attachments or URLs aiming to distribute one of at least 15 different malware payloads.

REFERENCE: https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel

TAGS: loda, njrat, revenge rat, asyncrat, vjw0rm, cve201711882, ransomware, ozone rat, TA558

ADVERSARY: TA558

INDUSTRIES: Transportation, Manufacturing, Hotel, Travel, Hospitality

MALWARE FAMILIES: njRAT, Ozone RAT, Revenge RAT - S0379, Loda

ATT&CK IDS: T1566 - Phishing, T1036 - Masquerading, T1059 - Command and Scripting Interpreter, T1059.001 - PowerShell, T1053.005 - Scheduled Task

Read More:

https://otx.alienvault.com/pulse/62fe1e074b82e798cd731a70