In a recent reporting from Proofpoint, a small threat group tracked as TA558 has been targeting several corporations throughout the hospitality, travel, and hotel industries over the past four (4) years. TA558 has launched several campaigns and deployed several malicious payloads with the overall goal of significant financial gain for the threat group. Throughout 2022, TA558 has conducted roughly fifty (50) social engineering campaigns attempting to deliver malicious payloads through various methods: twenty (20) via file attachments, twenty-six (26) via infected URL hyperlinks, and some phishing emails combining both malicious URL’s and file attachments. Much like other recent campaigns, TA558 has shifted from utilizing macro-infected malware to infected ISO images and ZIP archives which contain payloads to be deployed on the compromised device. Other malicious tools and payloads that TA558 has utilized previously include the Revenge RAT, Loda, Vjw0rm, and the Async RAT. Research shows that TA558 threat actors favor the use of Spanish and Portuguese language in their campaigns, with very little social engineering emails scribed in English. With the extensive number of campaigns from TA558 threat actors and a clear financial motive, CTIX believes that this activity will continue to persist and evolve in the weeks to come.