Metador - G1013

Created: 2023-01-25T23:57:51.818Z

Modified: 2023-04-14T12:25:35.434Z

Contributors: Massimiliano Romano, BT Security,Sittikorn Sangrattanapitak

Aliases

Metador

Description

Metador is a suspected cyber espionage group that was first reported in September 2022. Metador has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group Metador based on the "I am meta" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.(Citation: SentinelLabs Metador Sept 2022)

Techniques Used

Metador has encrypted their payloads.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Metador has quickly deleted

Metador has used Microsoft's Console Debugger in some of their operations.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Metador has downloaded tools and malware onto a compromised system.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Metador has used the Windows command line to execute commands.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as

Metador has used unique malware in their operations, including

metaMain and

Mafalda.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|