From Guest Complaints to Malware: Blockchain Abuse Targets Hotels

This threat involves email campaigns targeting hotels and accommodation providers by sending fake guest complaints, reviews, and inquiries. The emails contain malicious LNK shortcut files disguised as images that deploy malware families EtherRAT and TONResolver. These malware families uniquely resolve their command and control infrastructure by querying public blockchain APIs (Ethereum for EtherRAT and TON for TONResolver) instead of relying on hardcoded domains. This technique allows operators to rotate their infrastructure cheaply and evade traditional takedown efforts. The campaigns represent an evolution from previous Booking.com spoofing operations that used fake CAPTCHAs to deliver remote access trojans. Additionally, the threat actors likely leverage generative AI to produce unique email variants, increasing the difficulty of detection.

The malware deployed can establish persistent command and control channels by abusing blockchain APIs, making traditional domain-based detection and takedown ineffective. This enables sustained remote access and control over infected systems within the accommodation industry, potentially leading to data compromise or further malicious activity. The use of generative AI to create unique phishing emails increases the likelihood of successful delivery and infection.

No official patch or remediation is indicated. Organizations should enhance email filtering to detect and block phishing emails with malicious LNK files, and educate staff to recognize fake guest complaints and suspicious attachments. Monitoring for indicators of compromise such as the listed malicious domains and file hashes can aid detection. Due to the use of blockchain-based C2 infrastructure, traditional domain blacklisting may be insufficient, so behavioral detection and endpoint protection are recommended.