All news with #rce tag
Mon, August 22, 2022
Fake Reservation Links Target Travel and Hospitality Industry
#Active Exploitation
#Backdoor Found
#Business Email Compromise
#Data Exfil via Tools
#Proofpoint
#RCE
#Threat Report
✈️ A longtime threat group tracked as TA558 has resumed phishing campaigns that spoof hotel or reservation notices to lure travelers into downloading malware. Campaigns increasingly deliver ISO and RAR container files via URLs that, when decompressed, execute batch scripts and PowerShell helpers to fetch RATs such as AsyncRAT. TA558 has shifted from macro-laden Office documents to containerized attachments after Microsoft limited macros. Travel organizations and customers should be wary of unexpected reservation emails and avoid opening unknown archives.