RevengeHotels campaign
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office and WordPad that stems from improper parsing of specially crafted files. Attackers trigger it by getting a user to open a malicious document, after which attacker-controlled code executes with the privileges of the logged-in user. Anyone running the affected Microsoft Office or WordPad software is exposed, and CISA notes the flaw has been leveraged in ransomware campaigns; no CVSS score is available in the source data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile), indicating active, ongoing exploitation. Do: Apply Microsoft's security updates for Office and Windows per vendor instructions, as required by CISA's KEV catalog; the flaw was publicly reported as fixed in Microsoft's April 2017 security updates. Until patched, treat unsolicited Office documents and email attachments as high-risk, since exploitation requires a user to open a crafted file. Verify that all Office and WordPad installations across the estate—especially endpoints that handle untrusted documents—have received the update. | 7.8 | 100% | KEV ransomware PoC ×6 |
| masshundreds of millions of Office installations worldwide (exact count unknown) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | booking.com | d data received from popular online travel agencies such as Booking.com. The attackers carried out spear-phishing campaigns using w |
Full article636 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 28, 2019
RevengeHotels campaign – The hospitality industry continues to be a privileged target for cybercriminals that target hotels, restaurant chains, and tourism services.
Security experts at Kaspersky have published a report on a targeted cybercrime malware campaign, tracked as RevengeHotels, that hit hotels, hostels, hospitality and tourism companies. According to the experts, the threat actor has been active since 2015, but its activity peaked in 2019.
The group mainly operated in Brazil, experts confirmed that dozens of hotels are victims of the group. Kaspersky reported victims in eight states in Brazil, other attacks took place in Argentina, Bolivia, Chile, Costa Rica, France, Italy, Mexico, Portugal, Spain, Thailand, and Turkey.
“RevengeHotels is a targeted cybercrime malware campaign against hotels, hostels, hospitality and tourism companies, mainly, but not exclusively, located in Brazil.” reads the post published by Kaspersky. “We have confirmed more than 20 hotels that are victims of the group, located in eight states in Brazil, but also in other countries”
The cybercrime gang aimed at stealing card data of guests and travelers that were managed by hotels, as well as credit card data received from popular online travel agencies such as Booking.com.
The attackers carried out spear-phishing campaigns using weaponized Word, Excel or PDF documents as attachments. In some cases threat actors used CVE-2017-0199 exploit to deliver customized versions of RevengeRAT, NjRAT, NanoCoreRAT, 888 RAT and others.
The phishing messages are well-written, attackers used typosquatted domains used to impersonate real companies.
“The attached file, Reserva Advogados Associados.docx (Attorneys Associates Reservation.docx), is a malicious Word file that drops a remote OLE object via template injection to execute macro code. The macro code inside the remote OLE document contains PowerShell commands that download and execute the final payload.” continues the report.
“In the RevengeHotels campaign, the downloaded files are .NET binaries protected with the Yoda Obfuscator. After unpacking them, the code is recognizable as the commercial RAT RevengeRAT”
Researchers noticed an additional module called ScreenBooking that was developed by the threat actors to steal credit card data by monitoring whether the user is browsing the web page.
The files downloaded in the attacks observed in 2016 were divided into two modules, a backdoor and a module to capture screenshots. Over time, these modules had been merged into a single backdoor module that is able to gather data from clipboard and capture screenshots.”
Kaspersky also tracked another group behind a campaign tracked as ProCC that used a backdoor that is more customized than that used by RevengeHotels. ProCC hackers developed their backdoor from scratch, the malicious code is able to collect data from the clipboard and printer spooler, and capture screenshots.
Crooks also focused their attack on hotel management systems to capture credentials and payment card data. Crooks are maintaining remote access to front desks to generate additional income as a service.
“RevengeHotels is a campaign that has been active since at least 2015, revealing different groups using traditional RAT malware to infect businesses in the hospitality sector. While there is a marked interest in Brazilian victims, our telemetry shows that their reach has extended to other countries in Latin America and beyond.” states the report.
“If you want to be a savvy and safe traveler, it’s highly recommended to use a virtual payment card for reservations made via OTAs, as these cards normally expire after one charge. While paying for your reservation or checking out at a hotel, it’s a good idea to use a virtual wallet such as Apple Pay, Google Pay, etc. If this is not possible, use a secondary or less important credit card, as you never know if the system at the hotel is clean, even if the rooms are… “
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – RevengeHotels, malware)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/94500/cyber-crime/revengehotels-campaign-hospitality-industry.html