Tactics Used – RevengeHotels
Threat actors use to register typo-squatting domains impersonating the legitimate company names to trick the user believing the email is from the legitimate source.
They use to send emails with details for booking hotels and the spear-phishing email written in the Portuguese language with the malicious file named Reserva Advogados Associados(.)Docx (Attorneys Associates Reservation(.)Docx) attached.
When the user opens the attached malicious Word document, it drops a remote OLE(Object Linking and Embedding) object via template injection technique to execute the macro that presents inside OLE.
The macro that presents inside contains a PowerShell code that downloads the final payload. The final payload in one such example is a RevengeRAT, the threats include an additional module called ScreenBooking to steal credit card details.
When compared to RevengeHotels campaigns the malware used in ProCC campaigns are highly customized, the malware used is capable of collecting details from clipboard and printer spooler, and capture screenshots.
Data Sold on Underground Forums
The cybercriminals also sell the stolen customer credit card details on dark webs and also access to hotels.
“These criminals also infect front desk machines to capture credentials from the hotel administration software; they can then steal credit card details from it too,” reads the Kaspersky blog post.
Researchers believe the attack has global reach and victims confirmed in the following countries.
The campaign used customized versions of RevengeRAT, NjRAT, NanoCoreRAT, 888 RAT and a custom malware ProCC to compromise victim machines.
As the holiday season progresses attacks targeting the hospitality sector or on the rise, users can alternatively use virtual payment cards or wallets to stay safe.
To read the original article: