For criminal hackers, Brazilian hotel networks appear to be easy targets

The findings underscore Brazil’s longstanding struggles with cybercrime.

Cybercriminals have gone on a spree in Brazil’s hospitality industry, infecting the networks of hotels and tourism companies with malware that steals credit card data, according to researchers at Kaspersky.

All told, the hackers have struck hospitality organizations in eight states across Brazil, and 20 hotels in that country and others around the world, Kaspersky said last week.

Active since 2015, the hackers have stepped up their activity this year.  They are brazenly selling access to hotel networks they’ve breached to whoever is buying. 

Some Brazilian criminals tout the extracted credit card data “as high quality and reliable” because it came from a hotel administration system, the researchers wrote in a blog post.

The breaches often begin with spearphishing emails in fluent Portuguese to hotel employees. Once clicked, the emails open up malware capable of capturing data that flows downstream during the reservation process from popular sites like Booking.com.

The findings underscore Brazil’s longstanding struggles with cybercrime. Online forums in Brazil are teeming with offers of hacking tools and chatter about companies that make easy targets. The country’s cybercriminal gangs are highly organized, made up of cells focusing on software development and money laundering, threat-intelligence company Recorded Future has found.

But the hacking campaigns, which Kaspersky researchers attributed to two different criminal groups they call RevengeHotels and ProCC, have also reached countries from Thailand to Turkey. That global reach is a reminder of the challenges the hospitality industry faces in securing customer payment data that comes from a variety of sources. Criminal groups like FIN7, for example, are adept at homing in on payment card processors used in the industry.

“The use of spear-phishing emails, malicious documents and RAT malware is yielding significant results for at least two groups we have identified in this campaign,” Kaspersky analysts concluded, building on previous research from Palo Alto Networks.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure