Loading story…
A suspected DarkHotel campaign targeted luxury hotels in Macao with spear-phishing emails carrying malicious Excel attachments disguised as inquiries from the Macao Government Tourism Office. Researchers said the operation hit management personnel at at least 17 hotels, including Grand Coloane Resort and Wynn Palace, and used macros, VBS, and PowerShell to collect system information and exfiltrate data to the command-and-control domain fsm-gov.com. The activity was assessed with only moderate confidence as DarkHotel-linked because infrastructure tied to the campaign had also appeared in unrelated criminal phishing activity.
The intrusion relied on Windows Scheduled Tasks to maintain persistence and repeatedly execute payloads, including tasks created through a COM object rather than only via schtasks.exe, a method that can evade detections focused on command-line task creation. Hunting guidance highlighted suspicious Office behavior such as Excel loading taskschd.dll and wshom.ocx, short-lived tasks running every five minutes, and task names like MicrosoftOneDriveMgmt and MicrosoftOneDriveSync. Defenders were advised to monitor scheduled task creation logs, image-load telemetry, and task executions from user-writable paths, and to use Microsoft Defender for Endpoint Attack Surface Reduction rules to block or audit Office applications creating executable content.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
A March 2022 blog post documented detection and hunting guidance for scheduled tasks created through the Task Scheduler COM object rather than schtasks.exe. The post tied the technique to activity moderately attributed to DarkHotel and recommended telemetry from Defender for Endpoint, Sysmon, and Windows task creation logs.
The campaign appears to have slowed or stopped after January 18, 2022. Researchers suggested COVID-19 disruptions and the cancellation or postponement of relevant events in Macao may have reduced the operation's value to the attackers.
Red Canary published a threat report in 2022 describing how adversaries abuse Windows Scheduled Tasks for persistence and execution. The report highlighted common attacker patterns including schtasks.exe usage, SYSTEM-level tasks, and Qbot-linked regsvr32 execution.
On December 7, 2021, attackers sent an email to 17 hotels in the Macao area posing as the Macao Government Tourism Office. The message carried a malicious Excel attachment named “信息.xls” and was part of the suspected DarkHotel campaign.
In December 2021, the Macao Security Force Bureau became aware of the campaign and publicly warned about the suspicious domain used in it. The warning related to infrastructure tied to the phishing operation targeting local hotels.
A spear-phishing campaign targeting luxury hotels in Macao, China began in the latter half of November 2021. The operation focused on hotel management personnel and used malicious Excel attachments to gain access to hotel networks and booking systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
docs.microsoft.com
Open sourcetrellix.com
Open sourcecyberandramen.net
Open sourceredcanary.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hotels in Latin America were targeted with fake booking-request emails carrying malicious OpenDocument Text (`.odt`) attachments that delivered **AsyncRAT** through a multi-stage infection chain. HP Wolf Security reported that the `.odt` files used external OLE references to retrieve a remote Word document with embedded Excel files, which then prompted victims to enable macros. Researchers said the lures appeared in Spanish and Portuguese and found signs that similar activity had been running for months. The attack relied on **`mshta.exe`** to proxy execution and evade suspicion, using VBA macros to launch a sequence involving PowerShell, VBScript, and batch scripts before creating a scheduled task for persistence. The use of `mshta.exe` aligns with the MITRE ATT&CK technique **`T1218.005`**, which documents abuse of the legitimate Microsoft HTML Application Host as a living-off-the-land binary for stealthy code execution and payload staging. HP said the malicious `.odt` files showed exceptionally low antivirus detection, including a reported **0% detection rate on VirusTotal** at the time of analysis.
Aug 15, 2026
TA558, a financially motivated threat actor active since 2018, has persistently targeted hospitality, hotel, and travel organizations—primarily in Latin America—using Portuguese- and Spanish-language reservation and booking lures. Researchers linked the actor to repeated campaign markers such as the string **"CDT"**, fake travel and hotel branding, and attacker-controlled or compromised hospitality infrastructure. Proofpoint reported that TA558 expanded activity and shifted delivery techniques from macro-enabled Office files to URLs and container attachments such as `RAR` and `ISO`, while continuing to distribute a broad set of remote access trojans including **Loda RAT**, **Revenge RAT**, **AsyncRAT**, **njRAT**, **Ozone RAT**, and **Vjw0rm**. Multiple investigations show the campaigns using multi-stage infection chains to gain remote access and steal data. Cisco Talos documented **Loda RAT** delivery through phishing documents exploiting `CVE-2017-11882`, with capabilities including keylogging, screenshots, audio capture, FileZilla credential theft, and WMI-based antivirus enumeration. Uptycs tied a Brazilian hotel-themed lure, **"Rooming List Reservas para 3 Familias.docx,"** to **Revenge RAT** delivered via remote template injection and staged PowerShell and VBScript, while Elastic observed a related booking-themed chain using a fake **"Card & Booking Details.docx"** document to deploy **XWORM** and **Agent Tesla**, disable defenses, create persistence, and exfiltrate data through a Discord webhook. The activity indicates sustained credential theft, reconnaissance, follow-on malware delivery, and potential financial fraud against both travel-sector organizations and their customers.
Aug 15, 2026
Microsoft reported an active phishing campaign targeting hotel and hospitality organizations across Europe and Asia, using booking-, complaint-, and photo-themed emails to pressure recipients into opening malicious ZIP archives. The messages were routed through trusted services including Calendly and Google redirects, and in later activity used Cloudflare-fronted `.cfd` domains to evade detection. The ZIP files contained fake PNG shortcut (`.LNK`) files that launched obfuscated PowerShell, then installed a Node.js-based implant Microsoft tracks as **TonRAT**; Microsoft said the campaign has been active since April and evolved across multiple waves while keeping the same core infrastructure and tradecraft. On compromised systems, the attackers established persistence through `HKCU\Run` and `HKCU\RunOnce`, added Microsoft Defender process exclusions, and staged payloads in `Temp` and `ProgramData`, with some later samples dynamically compiling .NET DLLs via `csc.exe` and `cvtres.exe`. TonRAT communicated over encrypted WebSockets and used the TON blockchain API for command-and-control domain resolution, while Microsoft also observed beaconing on non-standard ports such as `56001` and `56002`, browser automation, geolocation lookups through `ip-api.com`, and forced shutdown commands. Microsoft has not attributed the activity to a known threat actor or confirmed follow-on ransomware or data theft, but said the operator is investing in obfuscation, persistence, and delivery evasion to maintain access for later actions.
Aug 11, 2026