If your flight’s already canceled and your hotel’s overbooked, the last thing you need is a fake confirmation email making things worse. That’s exactly what threat group TA558 is counting on.
After a COVID-era lull, this crew has ramped back up with targeted campaigns against the travel and hospitality sector. Their method: fake reservation emails containing links that deliver malware payloads.
What makes their latest campaign stand out from earlier efforts is the use of RAR and ISO file attachments. These compressed container files, once executed, decompress their contents and trigger the infection chain. A victim clicks the reservation link, downloads an ISO file, which contains a batch file, which runs a PowerShell script that eventually drops AsyncRAT onto the system.
Proofpoint researchers note TA558 conducted 27 campaigns using URLs in 2022 alone, compared to just five total between 2018 and 2021. The shift to ISO and RAR files likely tracks with Microsoft’s decision to disable macros by default in Office products.
Past campaigns leveraged CVE-2017-11882, a Microsoft Word remote code execution flaw, along with remote template URLs to deliver payloads like Loda and Revenge RAT. The current batch includes remote access trojans capable of reconnaissance, data theft and delivering follow-on malware.
Proofpoint assessed with medium-to-high confidence that TA558 is financially motivated, using stolen credentials and data to scale up money theft operations.
If you work in travel or hospitality — or just have a booking confirmation in your inbox — double-check the sender before clicking anything.
