Executive Summary
In the summer of 2025, the RevengeHotels cybercrime group (also tracked as TA558) significantly escalated its campaigns targeting the hospitality sector across Latin America, especially Brazil. Leveraging large language models (LLMs) to dynamically generate phishing lures and scripted malware loaders, the attackers delivered new VenomRAT payloads via sophisticated, invoice-themed phishing emails. These emails led hotel staff to malicious websites that dropped JavaScript and PowerShell-based loaders, ultimately granting persistent remote access for data theft and lateral movement. The attack exploited evolving tactics such as anti-kill mechanisms, registry persistence, custom encryption, and use of AI-generated code to evade detection.
This incident demonstrates a marked evolution in attacker methodology, combining commodity malware, AI-driven code generation, and targeted social engineering. Such developments highlight how AI is accelerating the sophistication and reach of cyber threats, particularly in sectors with high-value payment data and limited security resources.
Why This Matters Now
The RevengeHotels campaign exemplifies the growing threat posed by attackers leveraging AI to automate phishing and malware development, making detection and response more challenging. Its success in rapidly adapting lures and code underscores an urgent need for hospitality and travel businesses to bolster email and endpoint security, and highlights increased regulatory focus on protecting personal and payment data.
Attack Path Analysis
The attack began with targeted phishing emails containing malicious JavaScript and PowerShell loaders, leading to the download and in-memory execution of the VenomRAT implant. Once inside, the RAT exploited privilege escalation techniques to achieve persistence, evade security controls, and maintain administrative-level access. The attacker then enabled lateral movement options, including establishing tunnels with tools like ngrok, to potentially pivot across internal resources. VenomRAT set up encrypted command-and-control channels to receive instructions from its operators and facilitate remote management. Sensitive data was exfiltrated via outbound encrypted channels, with the RAT leveraging custom packet serialization and tunneling. Finally, the impact phase saw destruction of forensic artifacts, persistence reinforcement, security control disabling, and business risk through theft of payment data.
Kill Chain Progression
Initial Compromise
Description
Phishing emails with malicious JavaScript and PowerShell downloaders lured hotel staff into executing droppers that delivered the VenomRAT implant.
Related CVEs
CVE-2017-0199
CVSS 7.8A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, allowing an attacker to execute arbitrary code.
Affected Products:
Microsoft Office – 2010 SP2, 2013 SP1, 2016
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Phishing: Spearphishing Attachment
Command and Scripting Interpreter: Visual Basic
Command and Scripting Interpreter: PowerShell
Signed Binary Proxy Execution: Rundll32
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
System Information Discovery
Exfiltration Over C2 Channel
Indicator Removal on Host: Clear Windows Event Logs
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS v4.0 – Malware Protection
Control ID: 5.1.2
PCI DSS v4.0 – Authentication and Access Control
Control ID: 8.3.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Identity and Access Management
Control ID: Identity Pillar
NIS2 Directive – Cybersecurity Risk Management and Reporting Obligations
Control ID: Chapter IV, Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Hospitality
Primary target of RevengeHotels RAT campaign using VenomRAT to steal credit card data through phishing emails targeting Brazilian and Spanish-speaking hotel establishments.
Leisure/Travel
Tourism companies face elevated Remote Access Trojan risks from AI-enhanced phishing attacks exploiting booking confirmations and job applications for data exfiltration.
Financial Services
Credit card payment processing systems vulnerable to VenomRAT's data theft capabilities, requiring enhanced egress security and anomaly detection for transaction protection.
Information Technology/IT
IT infrastructure faces sophisticated RAT deployment through JavaScript loaders and PowerShell downloaders, necessitating zero trust segmentation and east-west traffic monitoring.
Sources
- RevengeHotels: a new wave of attacks leveraging LLMs and VenomRAThttps://securelist.com/revengehotels-attacks-with-ai-and-venomrat-across-latin-america/117493/Verified
- Kaspersky discovers the return of RevengeHotels, leveraging AI in attacks on Brazilian hotelshttps://www.kaspersky.com/about/press-releases/kaspersky-discovers-the-return-of-revengehotels-leveraging-ai-in-attacks-on-brazilian-hotelsVerified
- Kaspersky warns travelers: AI-powered attacks are targeting hotel guestshttps://me-en.kaspersky.com/about/press-releases/kaspersky-warns-travelers-ai-powered-attacks-are-targeting-hotel-guestsVerified
- APT and financial attacks on industrial organizations in Q2 2025 | Kaspersky ICS CERThttps://ics-cert.kaspersky.com/publications/reports/2025/09/04/apt-and-financial-attacks-on-industrial-organizations-in-q2-2025/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Implementing CNSF controls such as Zero Trust Segmentation, East-West Traffic Security, Egress Policy Enforcement, and Threat Detection would have limited the attack by isolating workloads, restricting unauthorized communication, detecting anomalous activity, and preventing unmonitored C2 channels and exfiltration.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Extended threat visibility and enforcement on malicious loader execution.
Control: Threat Detection & Anomaly Response
Mitigation: Early detection of privilege escalation behaviors and unauthorized process activity.
Control: Zero Trust Segmentation
Mitigation: Microsegmentation restricts cross-workload propagation of RAT traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Egress controls block unauthorized C2 channels and filter malicious domains.
Control: Encrypted Traffic (HPE) & Egress Security
Mitigation: Encryption-aware egress inspection detects and blocks unauthorized data exfiltration.
Anomalous system activity and policy enforcement increase resilience to destructive actions.
Impact at a Glance
Affected Business Functions
- Reservations
- Payments
- Guest Services
Estimated downtime: 7 days
Estimated loss: $500,000
Potential exposure of guests' credit card information and personal data due to unauthorized access facilitated by VenomRAT.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Zero Trust Segmentation to isolate workloads and restrict lateral movement of remote access malware.
- • Enforce robust egress controls to block unauthorized outbound traffic and prevent command-and-control or exfiltration channels.
- • Enable distributed threat detection and anomaly response to rapidly surface and respond to privilege escalation, persistence tactics, and destructive activities.
- • Monitor all encrypted traffic for anomalies and inspect egress flows to sensitive destinations, even if traffic is encrypted at the transport or application layer.
- • Institute continuous endpoint and network policy enforcement through cloud-native security fabric controls to disrupt multi-stage attacks before critical impact.
