Hospitality-Sector Attacks Rise 32% as Phishing and Identity Abuse Lead Intrusions
Summary
Attacks targeting accommodation and food services rose 32% this quarter, while phishing reached 32% of activity. The article highlights identity- and email-led access, WAF and SD-WAN risks, cloud destructive activity, and defensive steps.
Key points
- Attacks targeting the sector rose 32%; ransomware exposure rose 8% to 103 organizations named on data-leak sites, with postings spread across rotating groups.
- Phishing accounted for 32% of activity; Spearphishing Link led observed techniques, while External Remote Services and Valid Accounts gained share.
- The article reports URI-encoding methods that can bypass WAF path rules and active exploitation of a Cisco Catalyst SD-WAN Manager authentication bypass, CVE-2026-76504.
- JADEPUFFER-linked activity used compromised Azure service principals to delete storage, a Key Vault, and application resources, and attempted to delete SQL databases.
- Recommended defenses include testing WAF and backend URI normalization, restricting management interfaces, applying Cisco updates, and limiting SD-WAN access to trusted IPs.
- The article advises placing RDP behind a VPN or gateway, enforcing MFA, and scoping Azure service principals to least privilege while alerting on destructive cloud control-plane activity.
Article Details
- Defense Focus
- Reduce initial access and disruption risk across accommodation and food services by hardening email, identity, internet-facing management, and cloud control planes, with technique-based detection across those environments.
- Detection Methods
- Test custom WAF rules against URI-encoding bypasses and verify that the WAF and backend normalize and decode URIs consistently.
- Monitor Cisco Catalyst SD-WAN Manager logs and admin API activity; hunt for unauthorized administrative actions.
- Tune endpoint detections for interactive lateral movement.
- Alert on destructive cloud control-plane activity, including bulk deletions, Key Vault changes, and changes to backup or recovery protections.
- Correlate remote-access activity, endpoint execution, and cloud control-plane actions; triage phishing and suspicious logins promptly.
- Data Sources
- WAF and backend URI handling
- Cisco Catalyst SD-WAN Manager logs and admin API activity
- Identity and remote-access telemetry
- Endpoint telemetry
- Network telemetry
- Cloud control-plane activity
- Email telemetry
- Rule Types
- Custom WAF path rules
- Endpoint detection rules for interactive lateral movement
- Cloud control-plane activity alerts
- Platforms
- Web application firewalls
- Identity and remote-access platforms
- Endpoint security platforms
- Cloud control planes
- Email security platforms
- Network security platforms
- Defensive Actions
- Restrict administrative interfaces and remove unused endpoints from internet exposure.
- Patch edge devices and known-exploited vulnerabilities promptly.
- Apply the Cisco software update, disable internet exposure of SD-WAN management, and restrict management access to trusted IPs; the article reports no workaround.
- Keep RDP off the internet by placing it behind a VPN or gateway, and enforce MFA on remote access, using phishing-resistant methods such as FIDO2 or passkeys where possible.
- Bind remote access to appropriate users, devices, and locations; block unapproved remote-access and file-transfer tools and allowlist those legitimately used by teams and vendors.
- Inventory service principals, client secrets, and certificates; rotate them and scope them to least privilege.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe article describes authenticated intrusion access through RDP as part of the sequence following credential capture.T1078 · Valid AccountsValid Accounts gained share, and the article describes phishing followed by credential capture and authenticated access.T1078.004 · Cloud AccountsThe JADEPUFFER-linked activity used compromised Azure service principals to perform destructive cloud actions.T1133 · External Remote ServicesExternal Remote Services gained share as an initial-access path.T1190 · Exploit Public-Facing ApplicationThe article reports active exploitation of a Cisco Catalyst SD-WAN Manager authentication bypass that allowed remote attackers to bypass API authentication and gain admin access; it also discusses URI-encoding bypasses reaching blocked or vulnerable web endpoints.T1485 · Data DestructionJADEPUFFER-linked activity deleted storage, a Key Vault, and application resources and attempted to delete SQL databases.T1566.001 · Spearphishing AttachmentSpearphishing Attachment increased in the sector's observed activity.T1566.002 · Spearphishing LinkSpearphishing Link was the leading observed technique in the sector, accounting for 13% of activity.
CVE
Threat Actors
AkiraThe article reports that Akira appeared in the sector's ransomware postings for the first time in the period discussed.DragonForceThe article reports that DragonForce, present in an earlier period's sector postings, dropped out of the current period's postings.INC RansomThe article reports that Inc Ransom appeared in the sector's ransomware postings for the first time in the period discussed.KrybitThe article reports that Krybit increased in ransomware postings naming organizations in the sector.LockBitThe article reports that LockBit, present in an earlier period's sector postings, dropped out of the current period's postings.QilinQilin appeared in the sector's ransomware postings; the article reports that The Gentlemen overtook it this quarter.Storm-2570The article says Storm-2570 used remote-access and cloud-transfer tools to steal data before encryption.The GentlemenThe article reports that The Gentlemen overtook Qilin in ransomware postings naming organizations in the accommodation and food services sector.
Vendors
Products
AI Model Brokeragents across identity, endpoint, network, cloud, and email. Each task is routed through the AI Model Broker, which selects the right model based on speed, cost, and accuracy. Telemetry is normalized throughAzureSD-WAN Manager authentication bypass, and a cloud-identity incident (“JADEPUFFER”) in which compromised Azure service principals were used to delete storage, a Key Vault, and application resources within hours.Cisco Catalyst SD-WAN Managermethods that bypass web application firewall (WAF) path rules, active exploitation of a Cisco Catalyst SD-WAN Manager authentication bypass, and a cloud-identity incident (“JADEPUFFER”) in which compromised AzureGreyMatterAccommodation and food services teams need speed without losing control of response decisions across payment, guest, and corporate environments. GreyMatter is designed for that operating model.Key Vaultincident (“JADEPUFFER”) in which compromised Azure service principals were used to delete storage, a Key Vault, and application resources within hours.Universal Translatorwhich selects the right model based on speed, cost, and accuracy. Telemetry is normalized through Universal Translator, giving the platform a unified view across existing tools so detections can run where the data
Tools
AnyDeskusers, devices, and locations. Block unapproved remote access and file-transfer tools such as Rclone and AnyDesk, and allowlist the ones your teams and vendors legitimately use. Tune endpoint detections for interactiveRClonethe right users, devices, and locations. Block unapproved remote access and file-transfer tools such as Rclone and AnyDesk, and allowlist the ones your teams and vendors legitimately use. Tune endpoint detections for