December 3, 2019 By Shane Schick 2 min read

A malware campaign dubbed RevengeHotels has successfully infected systems running the front desks of more than 20 hotels across multiple countries in an attempt to steal guests’ credit card information.

Research published by Kaspersky Labs late last week confirmed the attacks have been detected most often in Brazil, though infections have also taken place in Chile, France, Italy, Spain, Portugal, Turkey, Costa Rica, Mexico and Bolivia.

Besides credit card data, Trojans deployed in the campaign are also gathering financial information passed on through third-party sites like Booking.com. RevengeHotels has been active since 2015, researchers said, but has been more active in the past year.

Beware of That Sudden Group Booking Request

Front desks are often the busiest parts of most hotels, and cybercriminals are taking advantage of that in this phishing campaign. Those targeted will get an email supposedly coming from a large company or government organization, for example, that requests a quote for a group booking.

The sender addresses of these messages look legitimate, but often have a small difference in spelling with the organization they’re impersonating. This technique, also known as typosquatting, becomes easier to overlook because the RevengeHotels attackers make sure the message is detailed and professional in tone.

Researchers said the messages contain malicious Word, Excel or PDF attachments that make use of vulnerabilities such as CVE-2017-0199. Though Microsoft patched that Office-related bug in 2017, hotels whose systems weren’t updated will allow attackers to deploy a variety of custom Trojans. These include RevengeRAT, NanocoreRAT, ProCC, 888 RAT and NjRAT.

Once infected, a backdoor is used to take screenshots and collect clipboard data, while another module, called ScreenBooking, captures the credit card information. The data is then sent back to the attacker’s command-and-control (C&C) server via a tunnel created by the Trojans.

RevengeHotels is not alone in aiming at the hospitality sector. Researchers said another group, ProCC, is waging a similar campaign with an even more sophisticated backdoor.

Make Sure There’s No Vacancy For Threat Actors

Organizations have long known they need to help employees understand how to identify phishing attempts, but the RevengeHotels campaign is a good example of how security awareness training may need to be customized for specific kinds of users.

Of course, people can always make mistakes, which is why it’s a good idea to complement training programs with ahead-of-threat detection tools that can spot suspicious URLs or requests and block them outright.

More from

Poland spending $760 million on cybersecurity after attack

3 min read - Visitors to the Polish Press Agency (PAP) website on May 31 at 2 p.m. Polish time were met with an unusual message. Instead of the typical daily news, the state-run newspaper had supposedly published a story announcing that a partial mobilization, which means calling up specific people to serve in the armed forces, was ordered by Polish Prime Minister Donald Tusk beginning on July 1, 2024. Deputy Prime Minister Krzysztof Gawkowski refuted the claim on X (formerly Twitter). His post…

How generative AI Is expanding the insider threat attack surface

3 min read - As the adoption of generative AI (GenAI) soars, so too does the risk of insider threats. This puts even more pressure on businesses to rethink security and confidentiality policies.In just a few years, artificial intelligence (AI) has radically changed the world of work. 61% of knowledge workers now use GenAI tools — particularly OpenAI’s ChatGPT — in their daily routines. At the same time, business leaders, often partly driven by a fear of missing out, are investing billions in tools…

Water facilities warned to improve cybersecurity

3 min read - United States water facilities, which include 150,000 public water systems, have become an increasingly high-risk target for cyber criminals in recent years. This rising threat has demanded more attention and policies focused on improving cybersecurity.Water and wastewater systems are one of the 16 critical infrastructures in the U.S. The definition for inclusion in this category is that the industry must be so crucial to the United States that “the incapacity or destruction of such systems and assets would have a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today