TA558 is a financially motivated cybercriminal group that targets travel and hospitality organizations primarily in Latin America, North America, and Western Europe. Since 2018, they have used socially engineered emails with fake hotel reservation themes to deliver malware. Recent campaigns in 2022 have shifted to using URLs leading to ISO and RAR file attachments containing batch files that execute PowerShell scripts to download RAT malware such as AsyncRAT, Loda, and Revenge RAT. This shift is likely due to Microsoft disabling macros by default in Office products. The malware enables reconnaissance, data theft, and further payload distribution. TA558’s campaigns have increased in frequency in 2022, exploiting user interaction with malicious compressed files.

Successful exploitation results in infection with remote access trojans that can enable attackers to perform reconnaissance, steal sensitive data, and deploy additional malware. Both travel industry organizations and their customers are at risk of data compromise and financial loss. The threat group’s activity can disrupt operations and lead to financial fraud or theft.

No official patch or fix applies as this is a social engineering and malware delivery campaign. Organizations should educate employees and customers to be wary of unsolicited reservation emails, especially those containing links or compressed file attachments (ISO, RAR). Security teams should implement email filtering to block suspicious attachments and URLs. Since this is a known threat actor with evolving tactics, ongoing user awareness and endpoint protection are recommended.