ProCC

Executive Summary

ProCC is a threat actor targeting the hospitality sector through remote access Trojan (RAT) malware deployment via malicious email attachments. Their campaigns exploit known vulnerabilities such as CVE-2017-0199 and deploy customized RATs like RevengeRAT, NjRAT, NanoCoreRAT, and 888 RAT. ProCC's activities focus on data collection from infected systems, posing significant risks to sensitive information in the hospitality industry.

Goals & Targeting

ProCC's strategic objectives appear to be centered around espionage and data theft, particularly targeting sectors where sensitive customer information is abundant. Their focus on the hospitality industry, which handles vast amounts of personally identifiable information (PII) and transactional data, aligns with their malware capabilities for data extraction. The threat actor likely targets countries with significant tourism industries, as hotels and travel agencies are key components of such economies.

ProCC is a cyber threat actor specialized in targeting the hospitality sector using remote access Trojans (RATs). Their primary method of infection involves sending email attachments containing malicious payloads that exploit vulnerabilities such as CVE-2017-0199. Once deployed, these RATs provide ProCC with unauthorized access to victim systems, enabling data collection activities including clipboard content, printer spooler data, and screenshot captures. This level of access allows the threat actor to gather sensitive information, potentially compromising guest data, financial records, and operational systems. The targeting of the hospitality sector suggests a focus on industries handling large volumes of personal information and may have varying levels of cybersecurity maturity.

Key Capabilities

• Deployment of remote access Trojans (RATs)
• Customization of RAT payloads
• Exploitation of known vulnerabilities like CVE-2017-0199
• Data collection from infected systems
• Persistence and lateral movement within networks

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

ProCC's campaigns are characterized by their use of email-based attacks and RAT implants. Their targeting patterns suggest a focus on sectors with weak cybersecurity defenses and rich data repositories, such as the hospitality industry. Campaign activity appears to be ongoing, with recent sightings indicating active development and deployment of new malware variants. Notable past operations include multiple breaches affecting hotels and related services globally.

IOC Patterns

• Spear-phishing emails with malicious Office document attachments
• Remote access Trojan (RAT) payloads targeting Windows systems
• Exploitation of CVE-2017-0199 vulnerability
• Clipboard data theft
• Printer spooler activity manipulation
• Screen capture activities on infected machines

Recommended Actions

• Patch and mitigate known vulnerabilities like CVE-2017-0199
• Monitor email channels for suspicious attachments, especially from unknown senders
• Implement endpoint detection and response (EDR) solutions to detect RAT activity
• Conduct regular user training on phishing awareness
• Segregate network access for systems handling sensitive data
• Use threat intelligence feeds to block known ProCC-related domains and IP addresses

Suggested Tags