RevengeHotels Deploys AI-Powered Venom RAT in Brazil Hotel Cyberattacks

Russian cybersecurity firm Kaspersky has exposed new attacks by the TA558 threat actor (tracked as RevengeHotels) targeting hotels in Brazil and Spanish-speaking markets. The campaign, observed in summer 2025, deployed Venom RAT using AI-generated phishing scripts.

Key Findings

• Attack Method: Phishing emails with invoice themes deliver malicious JavaScript loaders and PowerShell downloaders.
• AI Involvement: A significant portion of the initial infector code appears generated by large language models (LLMs).
• Primary Target: Hospitality and travel organizations in Latin America, with stolen credit card data as the main goal.

Attack Chain Breakdown

1. Phishing Emails: Sent in Portuguese/Spanish with hotel reservation or job application lures.
2. JavaScript Payload: Downloads a script (suspected LLM-generated) to fetch additional malicious components.
3. PowerShell Downloader: Retrieves "cargajecerrr.txt" from external servers, which then loads Venom RAT.

Venom RAT Capabilities

• Based on open-source Quasar RAT, sold for $650 (lifetime license) or $350/month (bundled with HVNC/Stealer).
• Anti-Kill Mechanism: Terminates security processes, modifies DACL permissions, and ensures continuous operation.
• Persistence: Uses Registry modifications and marks itself as a critical system process.
• Lateral Movement: Spreads via USB drives and disables Microsoft Defender Antivirus.

Historical Context

RevengeHotels has targeted hotels since 2015, previously distributing malware like:

• Revenge RAT, NjRAT, NanoCoreRAT