Threat group.View on attack.mitre.org
Metador is a suspected cyber espionage group that was first reported in September 2022. Metador has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group Metador based on the "I am meta" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.
| Technique | Procedure example |
|---|---|
| T1027.013 Encrypted/Encoded File |
Metador has encrypted their payloads. |
| T1059.003 Windows Command Shell |
Metador has used the Windows command line to execute commands. |
| T1070.004 File Deletion |
Metador has quickly deleted `cbd.exe` from a compromised host following the successful deployment of their malware. |
| T1071.001 Web Protocols |
Metador has used HTTP for C2. |
| T1095 Non-Application Layer Protocol |
Metador has used TCP for C2. |
| T1105 Ingress Tool Transfer |
Metador has downloaded tools and malware onto a compromised system. |
| T1546.003 Windows Management Instrumentation Event Subscription |
Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as `cdb.exe`. |
| T1588.001 Malware |
Metador has used unique malware in their operations, including metaMain and Mafalda. |
| T1588.002 Tool |
Metador has used Microsoft's Console Debugger in some of their operations. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
