The threat actor identified as TA558 has been implicated in a new round of assaults that target hotels in Spanish-speaking markets and Brazil by distributing several remote access trojans (RATs), such as Venom RAT.
The behavior, which was noticed in the summer of 2025, is being linked by Russian cybersecurity outfit Kaspersky to a cluster it calls RevengeHotels.
Venom RAT implants are still being distributed by the threat actors using JavaScript loaders and PowerShell downloaders through phishing emails with invoice themes, the organization stated. This campaign appears to use large language model (LLM) agents to produce a huge amount of the initial infector and downloader code.
The results show a new tendency among cybercriminal organizations to use artificial intelligence (AI) to strengthen their tactics. RevengeHotels is a Latin American hospitality, hotel, and travel company that has been known to be operating since read more about TA558 Uses AI-Generated Scripts to Deploy Venom RAT in Brazil Hotel Attacks.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.