November 17, 2016 By Douglas Bonderud 2 min read

Known for billion-dollar bank heists from financial institutions worldwide, the Carbanak gang recently redesigned its flagship malware to target companies in the hospitality industry. According to Threatpost, the new strain targets hotel and restaurant call centers in the U.S.

While the code itself is fairly hard to detect and efficient at grabbing credit data, the real problem stems from social engineering. Call center agents, trained to be helpful and polite, are empowering the spread of this code as cybercriminals leverage existing reservation procedures to sneak their malware onto corporate systems.

Too Much Hospitality

As noted by SC Magazine, the new version of this old malware depends on helpful call center agents and Microsoft Word for success. It starts when attackers call customer service lines and claim they’re unable to submit reservations through the hotel or restaurant’s online portal. Then they ask if it’s possible to send an email attachment with their reservation request, which contains the Carbanak dropper.

While this seems like a relatively easy scam to spot, fraudsters have upped the ante by using callers who are fluent in English. They take the time to develop a rapport with customer service agents, making staff more willing to assist however they can. Callers stay on the line while they wait for agents to open their malicious attachments, then abruptly hang up.

Once opened, the attachment runs macros in Microsoft Word and uses an encoded .VBS script that can steal system information, take desktop screenshots and download additional malware, which enables it to map target networks and work its way into payment systems and card processing devices. According to IT World Canada, Carbanak also replaces existing svchost.exe processes with a custom version that seeks out specific antivirus tools and disables them to avoid detection.

Macro Management

While the form has changed, the intent remains the same — grab financial and credit card data and stay hidden as long as possible. But with the original malware version picked apart by security researchers over the last year, the gang needed a new iteration.

By blending multiple types of their existing malware suite and adding abilities such as remote desktop enabling, password stealing and email searching, Carbanak’s creators have made it difficult to detect before it gets to work and starts grabbing credit data.

But it’s not all bad news. Since the malware relies on .VBS to begin the infection process, disabling macros in Microsoft Word effectively cripples this code before it can do any damage. As noted by ZDNet, a resurgence of macro-based malware led Microsoft to include new group policy features that allow admins to block macro execution in risky environments. Activating this option is a surefire way to shut down any Carbanak compromises.

Cancel Carbanak’s Reservation

Despite the inherent risk of macros, however, willing and helpful customer service agents represent the biggest threat to hospitality organizations’ credit card data. Avoiding social phishing scams in this scenario is tough, especially when staff members are trained to minimize customer frustration and enable simple transactions.

The solution is a detailed policy that specifies what types of transactions are acceptable. For example, companies should clarify that any complaints about the online reservation portal — no matter how articulate or convincing — are escalated to technical support rather than avoided by accepting email attachments. If consumers complain, escalate the call up the chain of command.

The Carbanak gang is back and inviting itself into the networks of restaurants and hotels across the U.S. Cancel its reservation by disabling macro functions and empowering staff to detect phishy phone calls.

More from

How prepared are you for your first Gen AI disruption?

5 min read - Generative artificial intelligence (Gen AI) and its use by businesses to enhance operations and profits are the focus of innovation in virtually every sector and industry. Gartner predicts that global spending on AI software will surge from $124 billion in 2022 to $297 billion by 2027. Businesses are upskilling their teams and hiring costly experts to implement new use cases, new ways to leverage data and new ways to use open-source tooling and resources. What they have failed to look…

Cybersecurity crisis communication: What to do

4 min read - Cybersecurity experts tell organizations that the question is not if they will become the target of a cyberattack but when. Often, the focus of response preparedness is on the technical aspects — how to stop the breach from continuing, recovering data and getting the business back online. While these tasks are critical, many organizations overlook a key part of response preparedness: crisis communication.Because a brand’s reputation often takes a significant hit, a cyberattack can significantly affect the company’s future success…

Brands are changing cybersecurity strategies due to AI threats

3 min read -  Over the past 18 months, AI has changed how we do many things in our work and professional lives — from helping us write emails to affecting how we approach cybersecurity. A recent Voice of SecOps 2024 study found that AI was a huge reason for many shifts in cybersecurity over the past 12 months. Interestingly, AI was both the cause of new issues as well as quickly becoming a common solution for those very same challenges.The study was conducted…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today