CampaignPublished 22 Aug 2022

Fake Reservation Links Prey on Weary Travelers

Source Threatpost

Description

The TA558 threat group has increased campaigns targeting the travel and hospitality industries with fake reservation emails containing malicious links or attachments. These campaigns deliver malware payloads such as remote access trojans (RATs) via ISO and RAR file attachments, which victims must decompress and execute. The group has evolved tactics from using Office document exploits to container files due to changes in Microsoft Office macro policies. TA558 is financially motivated, aiming to steal data and money from organizations and customers in the travel sector.

Impact

Successful exploitation results in infection with remote access trojans that can enable attackers to perform reconnaissance, steal sensitive data, and deploy additional malware. Both travel industry organizations and their customers are at risk of data compromise and financial loss. The threat group’s activity can disrupt operations and lead to financial fraud or theft.

Defensive guidance

Organizations should educate employees and customers to be wary of unsolicited reservation emails, especially those containing links or compressed file attachments (ISO, RAR). Security teams should implement email filtering to block suspicious attachments and URLs. Since this is a known threat actor with evolving tactics, ongoing user awareness and endpoint protection are recommended.

Summary

TA558 is a financially motivated cybercriminal group that targets travel and hospitality organizations primarily in Latin America, North America, and Western Europe. Since 2018, they have used socially engineered emails with fake hotel reservation themes to deliver malware. Recent campaigns in 2022 have shifted to using URLs leading to ISO and RAR file attachments containing batch files that execute PowerShell scripts to download RAT malware such as AsyncRAT, Loda, and Revenge RAT. This shift is likely due to Microsoft disabling macros by default in Office products. The malware enables reconnaissance, data theft, and further payload distribution. TA558’s campaigns have increased in frequency in 2022, exploiting user interaction with malicious compressed files.

References

threatpost.com/reservation-links-prey-on-travelers/180462/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Aug 2026, 12:43 UTC

References

Community reviews