Threat Actor Infests Hotels With New RAT

RevengeHotels has expanded its arsenal with a new remote access trojan (RAT) in attacks targeting the hospitality sector, with VenomRAT implants seen in 2025. The group, also known as TA558, has focused on stealing hotel guests’ credit card information and typically begins with phishing emails redirecting victims to sites hosting malicious scripts.

In earlier campaigns the threat actor targeted hotels across Latin America, using malware families such as 888 RAT, NanoCoreRAT, NjRAT, RevengeRAT and the custom ProCC, and more recently added XWorm and DesckVBRAT. In a mid-2025 campaign, RevengeHotels switched to more sophisticated implants and tools, including VenomRAT, and began using AI to build JavaScript loaders and PowerShell downloaders, with phishing lures ranging from invoicing to fake job applications.

According to Kaspersky, the infection chain leads to VenomRAT which can harvest and exfiltrate files, set up a reverse proxy and bypass UAC protections, while also spreading via USB drives. The focus of the fresh campaign appears to be hotels and front desks in Brazil, though some phishing emails were in Spanish, suggesting expansion to other regions.