PHALT#BLYX Campaign Targeting Hospitality

Jan 5

BLUF

An ongoing social engineering and living-off-the-land (LotL) campaign is targeting the hospitality sector with the DCRat trojan via fake Booking.com phishing lures.

Executive Cost Summary

This cost analysis was developed by the CyberDax team using expert judgment and assisted analytical tools to support clarity and consistency.

For organizations affected by phishing-driven malware intrusion leveraging fake Booking.com lures and DCRat persistence:

Low-end total cost: $800,000 – $1.1M
(Rapid detection, limited endpoint spread, minimal data exposure)
Typical expected range: $1.3M – $2.2M
(Multiple properties affected, extended monitoring, legal review required)
Upper-bound realistic scenarios: $2.5M – $3.5M
(Widespread credential abuse, prolonged operational disruption, regulatory involvement)

Key cost driver:

Scale of endpoint and credential compromise across hotel properties
Duration of attacker dwell time enabled by social engineering and living-off-the-land techniques
Operational dependence on third-party booking platforms and centralized identity systems
Post-incident assurance requirements to re-establish trust with guests, partners, and insurers

Targeted Sectors

· Hospitality

· Hotels

· Resorts

Countries

· Primarily observed in regions where relevant Booking.com traffic is high, with general targeting across the sector.

Date of first reported activity

· Jan 5, 2026

Date of last reported activity update

· January 5, 2026

APT Names

· APT28

o Fancy Bear

o Tsar Team

o Strontium.

Associated Criminal Organization Names

· This activity is not associated with any criminal organizations at this time.

IOCs

· Attacker-controlled infrastructure hosting fake Booking.com pages (specific URLs not public in snippets).

Tools Used in Campaign

· DCRat

· Trusted Windows tools

TTPs

· T1566.002 Phishing

o Spearphishing Link Attackers send emails impersonating Booking.com reservation cancellation notices to hospitality staff.

· T1204.001 User Execution

o Malicious Link Victims are pressured into clicking a link that leads to a fraudulent website.

· T1189 Drive-by Compromise

o The campaign uses high-fidelity fake websites that simulate browser errors and system crashes to manipulate users.

· T1204.002 User Execution

o Malicious File After a simulated "Blue Screen of Death" (BSOD), victims are tricked into manually executing malicious code by pasting content into the Windows Run dialog.

· T1059 Command and Scripting Interpreter

o The attack involves executing scripts through native Windows tools to establish persistence.

· T1583.001 Acquire Infrastructure

o Domains The threat actors utilize attacker-controlled infrastructure and malicious domains to host fake booking sites.

· S0654 DCRat

o The primary payload is a customized version of the DCRat remote access trojan, used for long-term system access and data theft

Malware Names

· DCRat

o DarkCrystal RAT

Malware Sample

DCRat

sha256

ad99f1e23d8eb9eb25e71e080e4af6f32f7fcc96ef0f2102f16059c38de259d9

URL link to sample

· hxxps://bazaar.abuse.ch/sample/ad99f1e23d8eb9eb25e71e080e4af6f32f7fcc96ef0f2102f16059c38de259d9/#comments

CVE-2025-59287

CVSS Vectors 3.1

· (9.8) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nessus ID

· 271435

· 271436

· 271437

· 271438

· 271439

· 271440

· 271441

Is CVE-2025-59287 on the KEV list?

· Yes

What was the CISA patch by date?

· November 14, 2025

URL to patch information

· hxxps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287

Suggested rules / potential hunts

As a reminder, these are indicator rules. They are likely to be noisy.

For best results consider creating a data model and reviewing the traffic as a report.

Suricata

Detects suspicious URI paths often used for harvesting hotel staff credentials.

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"PHALT#BLYX Suspicious Admin Panel Access"; flow:established,to_server; content:"/admin/login.php"; http_uri; sid:2026001; rev:1;)

Identifies web scanners targeting Content Management Systems used in hotel portals.

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"PHALT#BLYX Web Scanner Detection"; flow:established,to_server; content:"Acunetix"; http_user_agent; sid:2026002; rev:1;)

Monitors for CVE-2025-59287 often leveraged in 2025–2026 adversary tradecraft

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"PHALT#BLYX Exploitation Attempt CVE-2025-59287"; flow:established,to_server; content:"|00 01 02 03|"; sid:2026003; rev:1;)

SentinelOne

Identifies attackers adding new local administrators, a common persistence tactic.

ProcessCmd RegExp "net\s+user(?:(?!\\s+/add)(?:.|\n))*\s+/add" AND ParentProcessName = "powershell.exe"

Monitors for RDP activity combined with unusual registry modifications often seen in this campaign.

ObjectType = "Registry" AND RegistryPath ContainsCIS "HKEY_LOCAL_MACHINE\SOFTWARE\EDRTest" AND RegistryValue = "100"

Hunts for unmanaged or unsigned PowerShell scripts, frequently used for lateral movement in the hospitality sector.

ProcessName ContainsCIS "powershell" AND IsSigned = "False" AND DstIP Is Not Empty

Splunk

These queries leverage Risk-Based Alerting (RBA) and correlation of hospitality-specific log sources.

Concurrent Logins from Disparate Locations: Detects potential shared or compromised hotel staff accounts.

index=hospitality_logs sourcetype=suricata_eve_ids_attack | stats dc(src_ip) as ip_count by user | where ip_count > 1

Insecure Web Access (Status 404 Spikes): Correlates Suricata alerts with failed web requests to find scanning activity.

index=hospitality_logs sourcetype=suricata status=404 | stats count by dest_ip, signature | where count > 50

Dormant Account Reactivation: Alerts when a previously inactive hospitality account is used for administrative tasks.

index=security_logs action=success | join type=left user [| inputlookup dormant_accounts.csv | fields user] | where isnotnull(user)

Delivery Method

\Phishing emails with a link to a malicious, high-fidelity fake Booking.com website.

Email Samples: Emails impersonate "Booking.com reservation cancellation notices," often mentioning large charges to create urgency.

References

Silicon Angle

· hxxps://siliconangle.com/2026/01/05/securonix-warns-phaltblyx-malware-campaign-targeting-hospitality-sector

MalwareBazaar