RevengeHotels: a new wave of attacks leveraging LLMs and VenomRAT

RevengeHotels, also known as TA558, has emerged in a new wave of attacks across Latin America, leveraging large language model–generated code and VenomRAT, with the campaign already observed in 2025. The group’s primary targets remain hotels and front desks, notably in Brazil, and phishing emails with invoicing themes or fake job applications are used to deliver JavaScript loaders that trigger VenomRAT implants.

According to Kaspersky, the attackers deploy a multi-stage infection chain that downloads and executes additional scripts, loads VenomRAT through Base64-encoded payloads, and uses AI-generated code in the initial infectors to facilitate in-memory loading of the final RAT implant. VenomRAT itself offers capabilities such as HVNC, file grabber and stealer, reverse proxy, and UAC exploitation, and includes anti-kill protections, persistence mechanisms, and Windows Defender evasion features.

The campaign also features USB spreading, process-hunting to terminate security tools, and a tactics consistent with RevengeHotels’ known behaviour, with indicators of compromise including Fat146571.js and SGDoHBZQWpLKXCAoTHXdBGlnQJLZCGBOVGLH_{TIMESTAMP}.ps1. According to Kaspersky, the infrastructure often uses legitimate hosting services and Portuguese-themed domain names to deliver the payloads.