Operation Comando

Executive Summary

Operation Comando is a cybercrime campaign suspected to originate from Brazil, focusing on the hospitality sector, likely with the goal of stealing credit card information and other sensitive data. The threat actor operates with low sophistication but has demonstrated persistence, using freely available tools and services to maintain an extended presence in target networks.

Goals & Targeting

Operation Comando's primary motivation appears to be financially driven, targeting the hospitality sector to gain access to credit card information and other valuable data. The group likely selects its victims based on the ease of access and the potential for significant financial gains, making it a highly targeted industry despite its lack of sophistication.

Operation Comando is a cybercrime campaign that appears to have originated in Brazil and focuses on targeting the hospitality sector. The group's operations are characterized by their use of minimal resources, including public domain name service (DDNS) providers and remote access tools, alongside basic software development knowledge using languages like VB.NET. Despite these limitations, the threat actor has managed to sustain campaigns for months, successfully collecting credit card information and potentially other types of data from victims in the hospitality industry. The campaign's success underscores how even low-budget operations can achieve significant results by focusing on vulnerabilities in sectors with high financial value targets.

Key Capabilities

• Use of public remote access tools
• Spear-phishing with VB.NET-based malware distribution
• Persistent operations using low-cost infrastructure (e.g., DDNS)
• Ability to exfiltrate sensitive financial data

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Operation Comando has demonstrated a clear pattern of targeting hospitality organizations for extended periods. The campaign's longevity may be attributed to its cautious use of basic yet effective tools and tactics, which allow it to evade detection while maintaining access to victim networks. Notable past operations include multiple hotel property infiltrations in Latin America and possibly Europe.

IOC Patterns

• Spear-phishing emails with VB.NET-based attachments
• Use of remote desktop protocol (RDP) for initial access and lateral movement
• Domain name system (DNS) tunneling or fast-flux domains for command and control
• Presence of known remote access tools in the network

Recommended Actions

• Implement strict email filtering to detect and block spear-phishing attempts
• Monitor RDP traffic for unauthorized access and implement multi-factor authentication
• Conduct regular vulnerability assessments on hospitality sector assets
• Enhance logging and monitoring of DNS queries for potential tunneling activities
• Educate employees on phishing signs and implement user awareness training

Suggested Tags