Known for billion-dollar bank heists from financial institutions worldwide, the Carbanak gang recently redesigned its flagship malware to target companies in the hospitality industry. According to Threatpost, the new strain targets hotel and restaurant call centers in the U.S.

While the code itself is fairly hard to detect and efficient at grabbing credit data, the real problem stems from social engineering. Call center agents, trained to be helpful and polite, are empowering the spread of this code as cybercriminals leverage existing reservation procedures to sneak their malware onto corporate systems.

Too Much Hospitality

As noted by SC Magazine, the new version of this old malware depends on helpful call center agents and Microsoft Word for success. It starts when attackers call customer service lines and claim they’re unable to submit reservations through the hotel or restaurant’s online portal. Then they ask if it’s possible to send an email attachment with their reservation request, which contains the Carbanak dropper.

While this seems like a relatively easy scam to spot, fraudsters have upped the ante by using callers who are fluent in English. They take the time to develop a rapport with customer service agents, making staff more willing to assist however they can. Callers stay on the line while they wait for agents to open their malicious attachments, then abruptly hang up.

Once opened, the attachment runs macros in Microsoft Word and uses an encoded .VBS script that can steal system information, take desktop screenshots and download additional malware, which enables it to map target networks and work its way into payment systems and card processing devices. According to IT World Canada, Carbanak also replaces existing svchost.exe processes with a custom version that seeks out specific antivirus tools and disables them to avoid detection.

Macro Management

While the form has changed, the intent remains the same — grab financial and credit card data and stay hidden as long as possible. But with the original malware version picked apart by security researchers over the last year, the gang needed a new iteration.

By blending multiple types of their existing malware suite and adding abilities such as remote desktop enabling, password stealing and email searching, Carbanak’s creators have made it difficult to detect before it gets to work and starts grabbing credit data.

But it’s not all bad news. Since the malware relies on .VBS to begin the infection process, disabling macros in Microsoft Word effectively cripples this code before it can do any damage. As noted by ZDNet, a resurgence of macro-based malware led Microsoft to include new group policy features that allow admins to block macro execution in risky environments. Activating this option is a surefire way to shut down any Carbanak compromises.

Cancel Carbanak’s Reservation

Despite the inherent risk of macros, however, willing and helpful customer service agents represent the biggest threat to hospitality organizations’ credit card data. Avoiding social phishing scams in this scenario is tough, especially when staff members are trained to minimize customer frustration and enable simple transactions.

The solution is a detailed policy that specifies what types of transactions are acceptable. For example, companies should clarify that any complaints about the online reservation portal — no matter how articulate or convincing — are escalated to technical support rather than avoided by accepting email attachments. If consumers complain, escalate the call up the chain of command.

The Carbanak gang is back and inviting itself into the networks of restaurants and hotels across the U.S. Cancel its reservation by disabling macro functions and empowering staff to detect phishy phone calls.