TA558 cybercrime group targets hospitality and journey orgsSecurity Affairs

Cybercrime group TA558 is behind a malware marketing campaign focusing on resort, hospitality and journey organizations in Latin America

Proofpoint researchers are monitoring a malware marketing campaign carried out by a cybercrime group, tracked as TA558, which is focusing on resort, hospitality and journey organizations in Latin America.

The group is a small prison risk actor, lively since a minimum of April 2018, using a number of malware in its assaults, together with Loda RAT, Vjw0rm, and Revenge RAT.

The malware was reused to steal private and monetary information from resort friends, together with bank card particulars, carry out lateral strikes, and ship further payloads.

The group primarily targets Portuguese and Spanish audio system, however consultants additionally famous assaults focusing on entities in Western Europe and North America.

Gang exercise spiked in 2022, assault chain initiates phishing campaigns with booking-themed lures resembling resort bookings.

“In 2022, Proofpoint noticed a rise in exercise in comparison with earlier years. Moreover, TA558 modified ways and started utilizing URLs and container recordsdata to distribute malware, possible in response to Microsoft’s announcement that it will start blocking VBA macros downloaded from the Web by default. learn the evaluation printed by Proofpoint.

Assaults carried out between 2018 and 2021 took benefit of emails containing weaponized Phrase paperwork containing malicious exploits or macros. Opening the recordsdata began the an infection course of.

In latest assaults, the cybercrime group began utilizing malicious URLs, RAR attachments, ISO attachments, and Workplace paperwork to ship the malware. The transfer is in response to Microsoft’s resolution to disable macros by default in Workplace merchandise.

Proofpoint reported that of the 51 campaigns carried out by risk actors in 2022, 27 of them took benefit of URLs pointing to ISO recordsdata and ZIP recordsdata, whereas between 2018 and 2021 solely 5 campaigns took benefit of this method.

Proofpoint reported that since 2018, TA558 has used a minimum of 15 completely different malware households, in some instances utilizing the identical C2 infrastructure. The gang leverages compromised resort web sites to host the malicious payloads.

The risk actor typically switches languages ​​in the identical week in an try to keep away from detection and attribute assaults.

TA558 additionally makes use of a number of notable patterns within the marketing campaign information, together with using sure strings, naming conventions and key phrases, domains, and so on. group and points associated to journey reserving lures.

“TA558 is an lively risk actor focusing on the hospitality, journey, and different associated industries since 2018. The exercise carried out by this actor might result in theft of company and buyer information, in addition to potential monetary loss. ”. concludes the report.

“Organizations, particularly these working in particular sectors in Latin America, North America and Western Europe, should concentrate on the ways, strategies and procedures of this actor.”

Observe me on twitter: @security issues Y Fb

Pierluigi Paganini

(SecurityIssues – piracy, TA558)

---

share on