TA558 Targets Hospitality Sector with AI-Generated Malware

The threat actor known as TA558 has been attributed to a fresh set of attacks delivering various remote access trojans (RATs) like Venom RAT to breach hotels in Brazil and Spanish-speaking markets. Russian cybersecurity vendor Kaspersky is tracking the activity, observed in summer 2025, to a cluster it tracks as RevengeHotels.

"The threat actors continue to employ phishing emails with invoice themes to deliver Venom RAT implants via JavaScript loaders and PowerShell downloaders. A significant portion of the initial infector and downloader code in this campaign appears to be generated by large language model (LLM) agents."

The findings demonstrate a new trend among cybercriminal groups to leverage artificial intelligence (AI) to bolster their tradecraft. Known to be active since at least 2015, RevengeHotels has a history of targeting hospitality, hotel, and travel organizations in Latin America with the goal of installing malware on compromised systems.

Evolution of the Threat

Early iterations of the threat actor's campaigns were found to distribute emails with crafted Word, Excel, or PDF documents attached, some of which exploit a known remote code execution flaw in Microsoft Office (CVE-2017-0199). Subsequent campaigns have demonstrated the threat actor's ability to refine their attack chains to deliver a wide range of RATs such as Agent Tesla, AsyncRAT, and LokiBot.

The main goal of the attacks is to capture credit card data from guests and travelers stored in hotel systems, as well as credit card data received from popular online travel agencies (OTAs) such as Booking.com.

AI-Powered Attack Chain

According to Kaspersky, the latest campaigns involve sending phishing emails written in Portuguese and Spanish bearing hotel reservation and job application lures to trick recipients into clicking on fraudulent links, resulting in the download of a WScript JavaScript payload.

"The script appears to be generated by a large language model (LLM), as evidenced by its heavily commented code and a format similar to those produced by this type of technology. The primary function of the script is to load subsequent scripts that facilitate the infection."

This includes a PowerShell script, which, in turn, retrieves and executes a downloader. The downloader fetches two additional payloads: a loader and the final Venom RAT malware.

Venom RAT Capabilities

Based on the open-source Quasar RAT, Venom RAT is a commercial tool equipped to siphon data, act as a reverse proxy, and features a potent anti-kill protection mechanism. It modifies system permissions to protect its process and actively terminates processes used by security analysts.

"The loop specifically targets those processes commonly used by security analysts and system administrators to monitor host activity or analyze .NET binaries... If the RAT detects any of these processes, it will terminate them without prompting the user."

Should the malware be executed with elevated privileges, it marks itself as a critical system process. Lastly, Venom RAT can spread via removable USB drives and attempts to disable Microsoft Defender Antivirus by tampering with the task scheduler and Registry.

"RevengeHotels has significantly enhanced its capabilities, developing new tactics to target the hospitality and tourism sectors. With the assistance of LLM agents, the group has been able to generate and modify their phishing lures, expanding their attacks to new regions."