CybercrimeMITRE G1013
Metador
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Metador primarily targets telecommunications, internet service providers, and universities in several countries in the Middle East and Africa. Metador’s attack chains are designed to bypass native security solutions while deploying malware platforms directly into memory. SentinelLabs researchers discovered variants of two long-standing Windows malware platforms, and indications of an additional Linux implant.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1027.013 Encrypted/Encoded FileT1059.003 Windows Command ShellT1070.004 File DeletionT1071.001 Web ProtocolsT1095 Non-Application Layer ProtocolT1105 Ingress Tool TransferT1546.003 Windows Management Instrumentation Event SubscriptionT1588.001 MalwareT1588.002 Tool
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.sentinelone.com/labs/the-mystery-of-metador-unpicking-mafaldas-anti-analysis-techniques/
- https://www.sentinelone.com/labs/the-mystery-of-metador-an-unattributed-threat-hiding-in-telcos-isps-and-universities/
- https://assets.sentinelone.com/sentinellabs22/metador#page=1
- https://attack.mitre.org/groups/G1013
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.