Another threat actor targeting hospitality, hotel, and travel organizations has re-emerged during the busy summer travel season: a smaller, financially motivated player named TA558.

According to new research from Proofpoint, the group has been around since 2018 but is stepping up its attacks this year, targeting Portuguese and Spanish speakers located in Latin America, as well as targets in western Europe and North America.

Spanish, Portuguese, and occasional English-language emails use reservation-themed lures with business-relevant themes (such as hotel-room bookings) to distribute malicious attachments or URLs.

Proofpoint researchers have counted 15 different malware payloads, most frequently remote access Trojans (RATs), that can enable reconnaissance, data theft, and distribution of follow-on malware.

These malware families occasionally overlap with command-and-control (C2) domains, with the most frequently observed payloads including Loda, Vjw0rm, AsyncRAT, and Revenge RAT.

The report explains that in recent years, TA558 has shifted tactics, starting to use URLs and container files to distribute malware.

"TA558 began using URLs more frequently in 2022. TA558 conducted 27 campaigns with URLs in 2022, compared to just five campaigns total from 2018 through 2021," according to the report. "Typically, URLs led to container files such as ISOs or zip files containing executables."

Sherrod DeGrippo, vice president of threat research and detection at Proofpoint, explains this is likely in response to Microsoft announcing it would begin blocking VBA macros downloaded from the Internet by default.

"This actor is unique in that they have used the same lure themes, language, and targeting since Proofpoint first identified them in 2018," she tells Dark Reading.

However, she points out they often change tactics, techniques, and procedures (TTPs) and have used different malware payloads over the course of their activity.

"This suggests the actor is actively changing and responding to what works best or is most effective in achieving initial infection, using tactics and malware widely used by a variety of threat actors," she says.

She explains like many threat actors in the threat landscape, TA558 has pivoted away from macros in attachments to using other filetypes and URLs to distribute malware.

"It is likely other actors targeting these industries will use similar techniques that we described previously," she says.

Threat actors have pivoted away from macro-enabled documents attached directly to messages to deliver malware, increasingly using container files such as ISO and RAR attachments and Windows Shortcut (LNK) files.

DeGrippo says the increase in activity by TA558 this year is not indicative of an increase of activity targeting the travel/hospitality industries in general.

"However, organizations in these industries should be aware of the TTPs described in the report, and ensure employees are trained to identify and report phishing attempts when identified," she advises.

Travel Industry in Threat Actor Crosshairs

Attacks against travel-related websites began to rise months ago as the industry recovered from COVID-19, a July report from PerimeterX indicated, with competitive scraping-bot requests increasing dramatically in Europe and Asia.

As the coronavirus pandemic ebbs and consumers look to resume annual vacation plans, fraudsters are refocusing their efforts from financial services to the travel and leisure industries, according to TransUnion's latest quarterly analysis.

Multiple cybercrime groups have been spotted this year selling stolen credentials and other sensitive personal information pilfered from travel-related websites, with the methods of malicious actors evolving due to the concentration on personally identifiable information.