Tag: malware as a service

Consider following on social media!

• WordPress
• Twitter
• Facebook

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

After reading this, you just may never trust writing a review ever again. And you know what, we don’t blame you. It’s getting pricey just to exist. We all enjoy traveling to new places, especially with our partners.

You may have seen or shared some photos of yourself or others on their romantic getaways from the kids, job, or life just in general on social media. But let’s say you visited a vacation spot, and it left a sour taste in your mouth, clearly, your next course of action is to fire up your computer and write a review.

However, you may want to hold your horses before letting that Sandals resort owner know how you really feel because not all websites are created equal or with good intentions.

We’re going to be going over what kind of attack this is, who is using it, the functionality and effects upon release, and what are some ways you can prevent this from being the beginning to the end of your vacations.

The Attack

We as humans have a common tendency to seek out others who align with our current or pending point of view. Sometimes when we can’t find this we may resort to posting online as a signal for someone to agree or just be wrong in their thought.

But given the current growing threat in the landscape of the internet, it seems like those days are about to be numbered due to malicious actors making use of the complaint form of TripAdvisor as an attack vector for cyber-attacks. This may sound absurd, but like Spandau Ballet, this much is true.

Who Can It Be Now

So, an old menace brings an onset of new challenges. The group operating behind the Cyclops campaign back in May 2023 had revamped and offered Knight ransomware as RaaS (Ransomware-as-a-Service)—this is the act of offering the use of ransomware with different payment plans to interested parties, on the RAMP hacking forum.

This was done with the intent to invite affiliates to join their scheme and share the profits from extorting victims. We’re not sure as to how many partake in this invite but it’s something to keep an eye out for.

Enjoy the read so far? Why don’t you consider subscribing so you can keep up to date?

That Sinking Feeling

So, how does something like this work, well, we’re glad you asked. This campaign was spotted by Bleeping Computer and after analyzing they found an HTML (Hypertext Markup Language) file, “TripAdvisor-Complaint-[random].PDF, htm”. When opening the file, a fake browser window is launched within the real one. This window displays a TripAdvisor website however, this is a spoofed domain name and URL (Uniform Resource Locator). This technique is called browser-in-the-browser (BitB).

This aims to trick users into thinking they’re on a trusted site but in reality, the stealing of your credentials is pending. What makes BitB attacks more dangerous is, unlike normal phishing attacks where the user is redirected to a malicious website, BitB attack does not require the victim to click on any link or download a file because the fake browser window is embedded in the HTML attachment itself. The user may not notice the difference between the real and fake browser windows, this is unless they pay close attention to the details or have security tools in place for detecting phishing attempts.

However, the fun doesn’t stop there, when interacting with this particular BitB, it pretends to be a complaint submitted, asking for the user to review it. When clicking on the “Read Complaint” button, an Excel XLL file is downloaded named “TripAdvisor_Complaint-Possible-Suspension.xll”.  This file delivers the malware payload to encrypt files appending the “.knight_l” extension to encrypted files’ names, where ‘l’ portion likely stands for ‘lite’.

Once this process is complete a ransom note will be created named “How to Restore Your Files.txt” in all the folders of the computer. The note will demand a payment of $5,000 to be sent to a listed Bitcoin address. Trust us, even if you find the means to pay the ransom, there will be no restoration of your files.

The Prevention

While reading this you probably think it’s the end of the world and that you may never go on vacation again. We’re here to tell you, that is not the case. A few ways of protecting yourself is familiarizing yourself with the actual website. When visiting a website make sure you look for “https” and a lock image in your search bar as this will ensure that not only the site is secure, but your personal information is encrypted.

Some fake websites will be harder to spot since scammers are kind of clever, so they’ll be sure to come as close to mimicking the real website as possible, but a bit of mindfulness and staying up to date with your operating system and rising threat trends could safeguard you for your next vacation.

Always remember it’s better to file a complaint with the real TripAdvisor. Sure, they might not listen to you and take your money but it’s better than the alternative of scammers holding your data hostage with the intent to sell at a cost way lower than that Sandals resort owner had charged you.

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, sharing this with whomever, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Do you feel like there is something I may have missed on Knight ransomware? Script a comment below.