December 3, 2019 By Shane Schick 2 min read

A malware campaign dubbed RevengeHotels has successfully infected systems running the front desks of more than 20 hotels across multiple countries in an attempt to steal guests’ credit card information.

Research published by Kaspersky Labs late last week confirmed the attacks have been detected most often in Brazil, though infections have also taken place in Chile, France, Italy, Spain, Portugal, Turkey, Costa Rica, Mexico and Bolivia.

Besides credit card data, Trojans deployed in the campaign are also gathering financial information passed on through third-party sites like Booking.com. RevengeHotels has been active since 2015, researchers said, but has been more active in the past year.

Beware of That Sudden Group Booking Request

Front desks are often the busiest parts of most hotels, and cybercriminals are taking advantage of that in this phishing campaign. Those targeted will get an email supposedly coming from a large company or government organization, for example, that requests a quote for a group booking.

The sender addresses of these messages look legitimate, but often have a small difference in spelling with the organization they’re impersonating. This technique, also known as typosquatting, becomes easier to overlook because the RevengeHotels attackers make sure the message is detailed and professional in tone.

Researchers said the messages contain malicious Word, Excel or PDF attachments that make use of vulnerabilities such as CVE-2017-0199. Though Microsoft patched that Office-related bug in 2017, hotels whose systems weren’t updated will allow attackers to deploy a variety of custom Trojans. These include RevengeRAT, NanocoreRAT, ProCC, 888 RAT and NjRAT.

Once infected, a backdoor is used to take screenshots and collect clipboard data, while another module, called ScreenBooking, captures the credit card information. The data is then sent back to the attacker’s command-and-control (C&C) server via a tunnel created by the Trojans.

RevengeHotels is not alone in aiming at the hospitality sector. Researchers said another group, ProCC, is waging a similar campaign with an even more sophisticated backdoor.

Make Sure There’s No Vacancy For Threat Actors

Organizations have long known they need to help employees understand how to identify phishing attempts, but the RevengeHotels campaign is a good example of how security awareness training may need to be customized for specific kinds of users.

Of course, people can always make mistakes, which is why it’s a good idea to complement training programs with ahead-of-threat detection tools that can spot suspicious URLs or requests and block them outright.

More from

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

How I got started: Cyber AI/ML engineer

3 min read - As generative AI goes mainstream, it highlights the increasing demand for AI cybersecurity professionals like Maria Pospelova. Pospelova is currently a senior data scientist, and data science team lead at OpenText Cybersecurity. She also worked at Interest, an AI cybersecurity company acquired by MicroFocus and then by OpenText. She continues as part of that team today.Did you go to college? What did you go to school for?Pospelova: I graduated with a bachelor’s degree in computer science and a master’s degree…

Europe’s Cyber Resilience Act: Redefining open source

3 min read - Amid an increasingly complex threat landscape, we find ourselves at a crossroads where law, technology and community converge. As such, cyber resilience is more crucial than ever. At its heart, cyber resilience means maintaining a robust security posture despite adverse cyber events and being able to anticipate, withstand, recover from and adapt to such incidents. While new data privacy and protection regulations like GDPR, HIPAA and CCPA are being introduced more frequently than ever, did you know that there is new…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today