TA558 is a financially-motivated cybercrime group known for distributing over 15 malware payloads using reservation-themed phishing lures.
Analyst brief
TA558 is a financially-motivated cybercrime group active since at least 2018. They primarily target the hospitality, travel, and related industries in Latin America, with occasional attacks in North America and Western Europe. Their main TTP involves sending phishing emails written in Portuguese, Spanish, or English that use reservation-themed lures, delivering malicious attachments or URLs to distribute over 15 different malware payloads. Defenders should focus on strengthening email security against reservation-themed phishing, especially in the stated languages, and monitor for macro-enabled document delivery.
TA558
unknown
Since 2018, security researchers tracked a financially-motivated cybercrime actor, TA558, targeting hospitality, travel, and related industries located in Latin America and sometimes North America, and western Europe. The actor sends malicious emails written in Portuguese, Spanish, and sometimes English. The emails use reservation-themed lures with business-relevant themes such as hotel room bookings. The emails may contain malicious attachments or URLs aiming to distribute one of at least 15 different malware payloads.
source: misp-galaxy
FAQ2
What industries does TA558 primarily target?+
TA558 primarily targets the hospitality, travel, and related industries.
What themes does TA558 use in its phishing emails?+
TA558 uses business-relevant themes such as hotel room bookings in its phishing emails.