Threat Actor Seizes Hotel Networks with New RAT

Fast Facts

1. RevengeHotels, a hacker group active since 2015, has expanded its toolkit by adding new remote access trojans (RATs) like VenomRAT and AI-generated scripts, targeting the hospitality sector primarily in Latin America and Brazil.
2. Their attacks commence with phishing emails—often exploiting hotel invoicing or fake job applications—to deliver malware via malicious websites, utilizing AI-driven JavaScript loaders and PowerShell downloaders to enhance infection success.
3. The malware, particularly VenomRAT, allows remote control, file exfiltration, and propagation through USB drives, with new tactics showing an evolution in operational sophistication.
4. The group is leveraging large language models (LLMs) to craft and adapt phishing content, indicating an increasing use of AI to widen their attack reach and effectiveness across multiple regions and languages.

Underlying Problem

Recently, the cybercriminal group known as RevengeHotels, active since 2015, has intensified its malicious activities targeting the hospitality sector, particularly hotels and front desks in Brazil and other Latin American countries. This group, also called TA558, employs sophisticated tactics such as phishing emails — often disguised as invoices or job applications — that redirect victims to malicious websites. These websites host AI-generated scripts that load malware, with the latest campaign utilizing evolving remote access Trojans (RATs), notably VenomRAT, which grants the attackers persistent and covert control over infected systems. Once compromised, these systems can be manipulated to exfiltrate sensitive guest data, including credit card information, and spread malware via USB drives. The report from Kaspersky highlights that RevengeHotels has expanded its toolkit with additional implants like XWorm and DesckVBRAT, and now leverages artificial intelligence to craft more convincing phishing content and loaders, indicating a significant evolution in their operational complexity and regional reach, as they move from Latin America to potentially broader territories.

The attackers, indirectly reported by cybersecurity firm Kaspersky, operate with the goal of stealing financial data and maintaining covert access to targeted hotel networks. Their use of AI-generated scripts demonstrates a strategic shift toward more dynamic and harder-to-detect infection methods, while the infection chain frequently culminates in deploying VenomRAT, which allows attackers to hijack infected machines through virtual desktop sessions. These tactics underscore a disturbing trend of cybercriminals adopting advanced technologies to enhance their capabilities and expand their influence, making the hospitality industry particularly vulnerable to such coordinated, high-tech assaults.

Risk Summary

RevengeHotels, a persistent hacking group active since 2015, has recently expanded its cyber arsenal by integrating advanced tools such as VenomRAT and leveraging artificial intelligence to enhance its malicious capabilities. Initially focused on stealing credit card data from hotel guests via spear-phishing campaigns that exploit fake invoices and job applications, the group now employs sophisticated AI-generated scripts to infect hotel systems, primarily targeting the hospitality sector in Latin America and beyond. Their infections, facilitated through malicious links or USB drives, enable persistent access, allowing attackers to exfiltrate sensitive information, maintain covert control over compromised systems, and evade security measures like User Account Control. The strategic upgrade in tactics—adding new remote access Trojans, using AI-driven loaders, and expanding regional reach—heightens the threat landscape for hospitality organizations, underscoring the critical need for robust cybersecurity defenses to counter such well-resourced and evolving cyber adversaries.

Fix & Mitigation

In the rapidly evolving landscape of cyber threats, swift and effective remediation is crucial to prevent significant damage and protect sensitive data, especially when malicious actors infiltrate hotel networks with sophisticated tools like Remote Access Trojans (RATs). Prompt action not only minimizes operational downtime but also helps preserve customer trust and avoid costly legal repercussions.

Mitigation Strategies

• Isolate affected systems to prevent spread
• Conduct immediate threat assessment
• Update and patch all software vulnerabilities
• Disable unauthorized remote access points

Remediation Steps

• Remove RAT infections using specialized malware removal tools
• Perform comprehensive network scans for hidden threats
• Change all passwords for affected accounts and systems
• Enhance network security measures, including firewalls and intrusion detection systems
• Educate staff on recognizing and responding to cyber threats
• Implement continuous monitoring for early detection of future incidents

Explore More Security Insights

Explore career growth and education via Careers & Learning, or dive into Compliance essentials.

Access world-class cyber research and guidance from IEEE.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1