The holiday hack – a reminder of why you shouldn’t always trust emails

It started with a database breach

As the pandemic is becoming endemic, many countries have created dedicated registration programs to facilitate tourism. One example is Thailand’s Thailand Pass. Travelers must upload Covid test results and their vaccination status to help border security manage entry into Thailand.

Unfortunately, this database of travelers got hacked recently, as detailed here. Many tourists got caught in the malspam campaign that kicked off after the breach. The Spamhaus researchers had the chance to analyze an infected machine of one such victim. Here is what they found:

Seemingly legitimate emails

Let’s call our unlucky tourist Mr X (original, we know!). Mr X’s flight was due to leave for Bangkok on the 22-Feb-22. Being an organized sort, he had already completed the required steps to get his Thailand Pass and was ready for his trip. But on 17-Feb-22, he received the following two emails:

You will note that the sender domains are passthailandteam.com and teampassthailand.com. These domains are definitely not related to the Thai government. However, if you don’t spend 24/7 looking for malicious emails, it’s understandable that they could easily be deemed legitimate.

With a little research, one can establish that these domains were registered on 15-Feb-22 and 16-Feb-22, respectively, just days before the miscreants used them to send email. In our world, this usually raises a giant red flag – how often do you register a domain and immediately use it? The answer is almost never!

Back to Mr X, who was due to fly five days after receiving the above two communications – these emails panicked him. Who wouldn’t be unnerved? Here he was busy picturing himself landing in Bangkok, making his way to the beach and drinking a Singha beer, watching the world go by, only to suddenly think he may not be allowed even to enter the country.

Diligently Mr X followed the instructions in the email, providing his full name, date of birth, and the last four digits of his passport number. The reason for requesting these details? We can’t be sure, but we strongly suspect it’s related to identity theft.

Meanwhile, the link in the second email led to a website where a ZIP called “qr_thailand_pass.zip” was downloaded. Once opened, the ZIP contained a seemingly innocuous HTML file that, when opened, showed the following webpage:

Once Mr X clicked “Download Document”, a VBS file called “status_report.vbs” was downloaded. In reality, the file wasn’t “downloaded”; instead, the HTML page contained some javascript code that mimicked a download. When double-clicked, the VBS file shows the following rather innocuous popup:

However, in the background, the VBS file downloaded and executed a Remote Administration Tool (or RAT) from https://archive.org/download/auto_20220216/auto.txt.

What’s interesting to note is that the miscreants hosted their malicious payload on “archive.org”. This is a very well-known website with a good reputation. In doing this, the cybercriminals were most likely trying to evade security software blocking websites with poor reputation.

What’s that credit card charge for?

Without giving these emails another thought, Mr X happily went on his trip. While in Thailand, on 02-Mar-22, he received a notification from Google Cloud Platform (GCP) with a charge of €93. Since he had some services with Google, he dismissed the notification as one of the usual recurring charges and continued to enjoy his vacation.

March passed, and Mr X received a notification from GCP that its charges for the past month were almost €1600! Suddenly alarm bells were ringing, so he contacted the Spamhaus researchers to investigate further.

The team uncovered that the crooks had created an exceptionally “CPU-hungry” Google Compute Engine (GCE) instance that had been grinding away for the whole of March and into April until they shut it down.

Upon reviewing the platform logs, they established that the instance was created on 18-Feb-22, only a few hours after Mr X downloaded and executed the infected file on his computer.