Cybercriminals Targeting Travel and Hospitality Sectors with Sophisticated Fake Reservation Malware Campaigns

The global travel and hospitality industries, already struggling with the logistical nightmares of flight cancellations, labor shortages, and overbooked accommodations, are now facing a heightened cyber security threat. A persistent and evolving threat group known as TA558 has significantly ramped up its malicious activities, exploiting the post-pandemic surge in travel to target businesses and unsuspecting tourists alike. By masquerading as legitimate reservation confirmation services, these cybercriminals are successfully deploying a variety of malicious payloads, ranging from information-stealing remote access trojans to sophisticated data-exfiltration tools.

Security researchers at Proofpoint have recently identified a strategic pivot in the group’s operations. After a noticeable lull in activity—likely corresponding to the global downturn in travel caused by COVID-19 restrictions—TA558 has returned with a revamped, high-volume campaign. This resurgence marks a transition from older, traditional phishing methods to more modern, evasive techniques designed to bypass the security measures implemented by major software providers.

A Strategic Shift in Delivery Mechanisms

For years, threat actors relied heavily on weaponized Microsoft Office documents, embedding malicious macros that would execute once a user enabled content. However, in late 2021 and early 2022, Microsoft made significant changes to its Office ecosystem, disabling Visual Basic for Applications (VBA) and XL4 macros by default. This move effectively neutralized one of the most common infection vectors used by cybercriminals.

TA558, demonstrating a high degree of technical adaptability, has responded to these security updates by shifting its focus toward container files. Instead of traditional Word or Excel documents, the group is now predominantly utilizing ISO and RAR archive files. These formats, when opened, act as a digital "Trojan horse." An ISO file, which is essentially a disk image, can be mounted by the Windows operating system as if it were a physical CD or DVD drive. This allows the attacker to hide malicious batch files or executable scripts inside a format that often bypasses standard email security filters that might otherwise flag suspicious document macros.

According to Proofpoint’s latest analysis, the transition is stark: in 2022 alone, TA558 conducted 27 distinct campaigns utilizing URLs as a delivery mechanism, a massive increase compared to the mere five campaigns observed throughout the entire 2018–2021 period. These URLs typically direct the user to download a compressed file—either a ZIP or RAR archive—or an ISO disk image containing a batch file. When the user executes the batch file, it triggers a PowerShell script that, in turn, fetches and executes a payload such as AsyncRAT, Loda, or Revenge RAT.

The Evolution of TA558: A Historical Chronology

The threat group TA558 has been active since at least 2018, consistently focusing its efforts on the hospitality and tourism sectors. Their modus operandi has always relied heavily on social engineering, crafting emails that appear to be urgent reservation confirmations or travel itineraries.

• 2018-2019: The Formative Years. The group initially focused on exploiting known vulnerabilities in the Microsoft Office Equation Editor, such as CVE-2017-11882. By sending malicious Word documents, they were able to achieve remote code execution on the target’s machine. During this period, their campaigns were heavily concentrated on organizations in Latin America, with emails written primarily in Portuguese or Spanish.
• 2020: Peak Activity and Diversification. The start of 2020 saw the group reach its most prolific output, with 25 separate campaigns launched in January alone. This period saw the integration of more complex tools, including malicious PowerPoint files and template injections. It was also during this time that TA558 began to broaden its geographic reach, experimenting with English-language lures to target North American and Western European markets.
• 2021: Refining the Arsenal. As defenses against macro-based attacks began to harden, the group experimented with various Remote Access Trojans (RATs), such as Loda and Revenge RAT, to maintain persistence on infected systems. Cisco Talos and Uptycs documented several campaigns during this period that highlighted the group’s ability to pivot its infrastructure rapidly.
• 2022-Present: The Post-Macro Era. The most recent phase of operations represents the group’s most technically mature iteration. By moving away from Office documents and embracing ISO/RAR containers, the group has successfully maintained its campaign tempo despite the industry-wide transition to more secure document handling.

Understanding the Payloads: The Risk of RATs

The ultimate goal of TA558 is financial gain, achieved through the deployment of Remote Access Trojans (RATs). These tools are significantly more dangerous than simple viruses; they provide the attacker with near-total control over the infected machine. Once a RAT like AsyncRAT or Loda is successfully installed, it can perform a variety of malicious actions, including:

1. Reconnaissance: The attacker can map the victim’s network, identify high-value systems, and steal sensitive credentials stored in browsers or local files.
2. Data Theft: By logging keystrokes or capturing screen images, the attackers can steal credit card information, login details for corporate booking systems, and personal identification data.
3. Persistence and Lateral Movement: Once they have a foothold, they can install additional malware, use the machine to send spam, or move laterally through the corporate network to compromise other systems.

Sherrod DeGrippo, vice president of threat research and detection at Proofpoint, emphasized the severity of these intrusions. "Its possible compromises could impact both organizations in the travel industry as well as potentially customers who have used them for vacations," DeGrippo noted. The implication is that the threat is not just limited to the internal operations of a hotel or airline, but extends to the entire supply chain of personal data shared by travelers.

Broader Implications for the Travel Sector

The fact that TA558 has specifically targeted the hospitality sector is no coincidence. The industry is characterized by high-volume transactions, a decentralized workforce, and a constant influx of external communications from guests. This environment makes it difficult for security teams to distinguish between a legitimate customer inquiry and a malicious phishing attempt.

For a hotel chain or a travel agency, the impact of a successful breach goes beyond the immediate loss of data. A compromised booking system could lead to widespread service disruptions, theft of customer financial records, and significant reputational damage. In the wake of recent high-profile cyberattacks, the hospitality sector has become a high-priority target for threat actors who understand that these companies often lack the robust IT security budgets of the banking or healthcare sectors.

Recommendations for Mitigation and Defense

Security analysts advise that organizations in the travel and hospitality sectors—particularly those with a footprint in Latin America, North America, and Western Europe—should review their security posture immediately. Key defensive strategies include:

• Email Filtering and Sandboxing: Given that the primary delivery mechanism is via email, organizations should deploy advanced email security solutions that can analyze attachments in a sandbox environment before they reach the end user.
• Policy-Based Blocking: Administrators should consider blocking the execution of ISO and RAR files from external email sources if they are not required for core business functions.
• User Awareness Training: Employees should be trained to recognize the signs of a phishing attempt, such as unexpected reservation emails, mismatched sender addresses, and high-pressure language.
• Endpoint Detection and Response (EDR): Deploying EDR solutions can help security teams identify and kill malicious processes, such as PowerShell scripts initiated by batch files, before they can download follow-on payloads.

As the travel industry continues its post-pandemic recovery, the threat posed by groups like TA558 is unlikely to dissipate. The group has proven its resilience by repeatedly adapting to new security hurdles. For businesses and travelers alike, the key takeaway is that the "digital itinerary" must be treated with as much caution as physical security. As long as the potential for financial theft remains high, the "reserva" emails will continue to arrive, necessitating a vigilant and proactive approach to cybersecurity across the entire global travel landscape.