Known for billion-dollar bank heists from financial institutions worldwide, the Carbanak gang recently redesigned its flagship malware to target companies in the hospitality industry. According to Threatpost, the new strain targets hotel and restaurant call centers in the U.S.

While the code itself is fairly hard to detect and efficient at grabbing credit data, the real problem stems from social engineering. Call center agents, trained to be helpful and polite, are empowering the spread of this code as cybercriminals leverage existing reservation procedures to sneak their malware onto corporate systems.

Too Much Hospitality

As noted by SC Magazine, the new version of this old malware depends on helpful call center agents and Microsoft Word for success. It starts when attackers call customer service lines and claim they’re unable to submit reservations through the hotel or restaurant’s online portal. Then they ask if it’s possible to send an email attachment with their reservation request, which contains the Carbanak dropper.

While this seems like a relatively easy scam to spot, fraudsters have upped the ante by using callers who are fluent in English. They take the time to develop a rapport with customer service agents, making staff more willing to assist however they can. Callers stay on the line while they wait for agents to open their malicious attachments, then abruptly hang up.

Once opened, the attachment runs macros in Microsoft Word and uses an encoded .VBS script that can steal system information, take desktop screenshots and download additional malware, which enables it to map target networks and work its way into payment systems and card processing devices. According to IT World Canada, Carbanak also replaces existing svchost.exe processes with a custom version that seeks out specific antivirus tools and disables them to avoid detection.

Macro Management

While the form has changed, the intent remains the same — grab financial and credit card data and stay hidden as long as possible. But with the original malware version picked apart by security researchers over the last year, the gang needed a new iteration.

By blending multiple types of their existing malware suite and adding abilities such as remote desktop enabling, password stealing and email searching, Carbanak’s creators have made it difficult to detect before it gets to work and starts grabbing credit data.

But it’s not all bad news. Since the malware relies on .VBS to begin the infection process, disabling macros in Microsoft Word effectively cripples this code before it can do any damage. As noted by ZDNet, a resurgence of macro-based malware led Microsoft to include new group policy features that allow admins to block macro execution in risky environments. Activating this option is a surefire way to shut down any Carbanak compromises.

Cancel Carbanak’s Reservation

Despite the inherent risk of macros, however, willing and helpful customer service agents represent the biggest threat to hospitality organizations’ credit card data. Avoiding social phishing scams in this scenario is tough, especially when staff members are trained to minimize customer frustration and enable simple transactions.

The solution is a detailed policy that specifies what types of transactions are acceptable. For example, companies should clarify that any complaints about the online reservation portal — no matter how articulate or convincing — are escalated to technical support rather than avoided by accepting email attachments. If consumers complain, escalate the call up the chain of command.

The Carbanak gang is back and inviting itself into the networks of restaurants and hotels across the U.S. Cancel its reservation by disabling macro functions and empowering staff to detect phishy phone calls.

More from

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Why Zero Trust Works When Everything Else Doesn’t

The zero trust security model is proving to be one of the most effective cybersecurity approaches ever conceived. Zero trust — also called zero trust architecture (ZTA), zero trust network architecture (ZTNA) and perimeter-less security — takes a "default deny" security posture. All people and devices must prove explicit permission to use each network resource each time they use that resource. Using microsegmentation and least privileged access principles, zero trust not only prevents breaches but also stymies lateral movement should a breach…

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…