APT28 Targets Hospitality Sector, Presents Threat to Travelers « Threat Research Blog | FireEye Inc

FireEye attributes a campaign to APT28 that targeted hotels across Europe and the Middle East using a spear-phishing document (Hotel_Reservation_Form.doc) which drops GAMEFISH malware; the actor leveraged Responder for NetBIOS/NBT-NS poisoning to harvest credentials and used the EternalBlue SMB exploit and py2exe-compiled tools for lateral movement, with observed IOCs including MD5 hashes and the mvband.net C2 domain. The report warns travelers and hospitality operators about credential theft via public Wi‑Fi and the evolving tactics of state-aligned actors.