Machete - G0095

Created: 2019-09-13T12:37:10.394Z

Modified: 2021-10-06T19:26:47.988Z

Contributors: Matias Nicolas Porolli, ESET

Aliases

Machete,APT-C-43,El Machete

Description

Machete is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010. It has primarily focused its operations within Latin America, with a particular emphasis on Venezuela, but also in the US, Europe, Russia, and parts of Asia. Machete generally targets high-profile organizations such as government institutions, intelligence services, and military units, as well as telecommunications and power companies.(Citation: Cylance Machete Mar 2017)(Citation: Securelist Machete Aug 2014)(Citation: ESET Machete July 2019)(Citation: 360 Machete Sep 2020)

Techniques Used

Machete has distributed

Machete through a fake blog website.(Citation: Securelist Machete Aug 2014)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Machete has embedded malicious macros within spearphishing attachments to download additional files.(Citation: 360 Machete Sep 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Machete has used batch files to initiate additional downloads of malicious files.(Citation: 360 Machete Sep 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.007|Msiexec|

Machete has used msiexec to install the

Machete malware.(Citation: 360 Machete Sep 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Machete's

Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.(Citation: 360 Machete Sep 2020)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Machete has created scheduled tasks to maintain