{"id":22846,"date":"2024-06-04T17:30:46","date_gmt":"2024-06-04T13:30:46","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/attacks-on-hotel-business\/22846\/"},"modified":"2024-06-04T17:31:01","modified_gmt":"2024-06-04T13:31:01","slug":"attacks-on-hotel-business","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/attacks-on-hotel-business\/22846\/","title":{"rendered":"E-mail attacks on the hotel business"},"content":{"rendered":"

Since last summer, both hotel owners and employees have been receiving malicious e-mails disguised as ordinary correspondence from previous or potential guests. In some cases, they appear as typical messages sent to the target hotel\u2019s public e-mail address. In others, they resemble urgent requests from Booking.com to respond to user comments the platform supposedly received. In reality, it\u2019s attackers trying to either get hold of employees\u2019 login credentials or infect hotel systems with malware.\n<\/p>\n

Tricks of the trade<\/h2>\n

\nWhen targeting organizations, threat actors usually need a plausible pretext for their e-mails. In the case of hotels, devising such a pretext is relatively easy: responding to sudden customer inquiries is part and parcel of the job for hotel workers with publicly available e-mail addresses. The be-all-and-end-all for a hotel is reputation, so employees strive to resolve conflicts or fulfill requests as quickly as possible. This eagerness leads them to follow links or open attached files within these e-mails, falling prey to cybercriminals. In essence, this threat could be described as a \u201ccustomer focus attack\u201d.<\/p>\n

Adding to the challenge of identifying the threat is the fact that attackers don\u2019t need to create a specific, business-appropriate e-mail address. Hotel staff routinely receive inquiries and complaints from guests using free e-mail services. So attackers use them too \u2014 with Gmail being the most common.\n<\/p>\n

E-mail content<\/h2>\n

\nGenerally, the correspondence follows one of two topics: complaints, or inquiries to clarify some details. In the first case, hotel employees receive a message from a \u201cdissatisfied guest\u201d. The complaint could be about unethical staff, double-charged bank cards, poor accommodation conditions, and so on. To back up their words, attackers may offer supporting evidence such as videos, photos, bank statements and the like.<\/p>\n

\"Example<\/a>

Example of a complaint regarding a conflict that allegedly occurred in a hotel<\/p><\/div>\n

Early this year, attackers modified their tactics. Instead of direct complaints, they started sending e-mails disguised as notifications from Booking.com \u2014 the popular online accommodation booking platform. The essence remains the same: someone supposedly left a negative review on the platform that hotel staff need to address as a matter of extreme urgency. This may seem like a different scam altogether, but the attack\u2019s goals and the e-mail technical headers (throwing light on the mailing engine) indicate that these e-mails are part of the same campaign.<\/p>\n

\"E-mail<\/a>

E-mail mimicking a notification from Booking.com<\/p><\/div>\n

In the inquiry-based e-mails, attackers pose as potential guests and request additional information about hotel services and pricing. The options are endless, with each message\u2019s subject and content almost always unique. Besides routine questions about transfers, meals, and rates, these pseudo-guests may inquire about a playroom for kids, a quiet space for remote work, or the availability of rooms with special historical or cultural significance.<\/p>\n

Here are some more examples of phishing e-mail subjects and content:<\/p>\n