Massive Photo ZIP Campaign Targets Booking.com Partner and Other Hotels across Japan and Europe

MITRE Techniques

• [T1204.002 ] User Execution: Malicious File – Users were tricked into launching fake image shortcut files inside photo-themed ZIP archives, starting the attack chain (‘users were tricked into downloading photo-themed ZIP archives… fake image shortcut files that, when launched, started an attack chain’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – An obfuscated PowerShell script was used as part of the initial execution chain (‘an obfuscated PowerShell script’).
• [T1027 ] Obfuscated Files or Information – The attack chain relied on obfuscation to hinder analysis and conceal malicious behavior (‘obfuscation and persistence were ensured’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Dual registry persistence was used to maintain access on infected devices (‘dual registry persistence’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – C&C communications were carried out over network services using nonstandard ports, indicating protocol-based command-and-control traffic (‘C&C communications over nonstandard ports’).
• [T1071.004 ] Application Layer Protocol: DNS – The campaign included DNS-based infrastructure communication and lookups across domains and IPs (‘six DNS queries’, ‘historical domain-to-IP resolutions’).
• [T1583.001 ] Acquire Infrastructure: Domains – The operators registered and used many domains for campaign infrastructure, including typosquatted and likely malicious domains (‘five domain IoCs appeared in four typosquatting groups’, ‘likely registered with malicious intent’).
• [T1566.002 ] Phishing: Spearphishing Link – Phishing emails used multilingual lures and Google URL redirects to deliver links while bypassing checks (‘deliver phishing emails with multilingual lures and subject lines’, ‘Google’s URL redirect functionality’).
• [T1090.001 ] Proxy: Internal Proxy – Authentication laundering through legitimate services was used to obscure the true source of the messages (‘attempted to bypass conventional authentication checks through authentication laundering’).
• [T1105 ] Ingress Tool Transfer – The use of ZIP archives and downloadable artifacts suggests delivery of malicious payloads to victim systems (‘users were tricked into downloading photo-themed ZIP archives’).