Threat Intelligence Tarot
cups · 6
Criminal (Latin America focused)
G1008★★★★★
risk 3/5
✦ The False Itinerary ✦
TA558
HotelsTravel agenciesAirlinesLatin American hospitality sector
Active since ~2018 · Financial fraud, Latin American travel sector targeting, Remote access trojan deployment
It sends hotel staff a fake booking confirmation. The attachment is a reservation. The attachment is also a remote access trojan. The False Itinerary has spent years in the reservations inbox of hotels across Latin America, reading guest credit cards and booking data for financial fraud.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Hotel reservation system compromise across Latin America
- ◆Fake booking confirmations as spearphishing lures
- ◆RevengeRAT, AsyncRAT, and Loda RAT deployments
- ◆Travel industry targeting across 15+ countries
Defenses
- ▸Disable VBA macros and script execution from email attachmentsCIS Control 9 ↗
- ▸Hotel PMS system network segmentation from corporate emailCIS Control 12 ↗
- ▸RAT detection capabilities in endpoint securityNIST CSF: DE.CM ↗
- ▸Travel sector ISAC participation for threat intelligenceNIST CSF: ID.RA ↗
Reversed: Their Weakness
TA558's geographic concentration in Latin America and consistent targeting of the travel sector created predictable patterns that allowed industry-specific threat intelligence to build effective defenses - sector-specific sharing networks proved particularly valuable.
Share this adversary profile
swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.