LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1059: metaMain

metaMain is a backdoor used by Metador to maintain long-term access to compromised machines; it has also been used to decrypt Mafalda into memory.[1][2]

EnterpriseS1059MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

metaMain is a Windows backdoor documented by ATT&CK as being used by Metador to maintain long-term access to compromised machines and to decrypt Mafalda into memory. Its value to defenders is less about a single malware name and more about the access pattern it represents: persistent remote control, in-memory payload handling, collection, credential/input capture, local staging, and exfiltration over command-and-control channels. For business leaders, this is a continuity and incident-response concern because long-term backdoor access can turn a single compromised endpoint into a platform for data theft, credential exposure, and further tool deployment.

Executive priority

Prioritize validation of endpoint, identity, and network visibility for Windows systems that handle sensitive data or privileged activity. The ATT&CK relationships show behaviors tied to collection, credential access, stealth, persistence, command-and-control, and exfiltration, so leaders should ask whether the organization can prove: which hosts have suspicious persistence, which accounts were exposed, what data may have been staged or exfiltrated, and whether C2 traffic can be reconstructed during an investigation. This object is especially relevant to managed detection, incident response readiness, and audit evidence around logging, endpoint control, and data protection.

Technical view

SOC and IR teams should treat metaMain coverage as behavior-led rather than signature-led because ATT&CK provides no official detection text. Validate detections across the related techniques: local file and directory discovery, system/user/process discovery, process injection, registry modification, WMI event subscription persistence, encoded/encrypted artifacts, deobfuscation or in-memory payload handling, screen capture, keylogging/input capture, local data staging, file deletion, timestomping, ingress tool transfer, web or non-application-layer C2, internal proxying, port knocking, and exfiltration over C2. Since the malware platform is Windows, prioritize Windows endpoint telemetry while using network telemetry to confirm C2, proxying, transfer, and exfiltration hypotheses.

Likely telemetry

  • Windows endpoint process creation and parent/child process lineage
  • Windows registry modification events
  • WMI event filter, consumer, and binding activity
  • Endpoint memory/injection-related telemetry where available
  • File creation, deletion, rename, timestamp, and directory enumeration events

Detection direction

  • Build coverage around the ATT&CK-linked behavior chain rather than relying on the malware name alone.
  • Correlate discovery activity, persistence changes, tool transfer, staging, and outbound communications from the same Windows host or user context.
  • Tune for high-risk combinations such as WMI event subscription plus suspicious network callbacks, process injection plus encoded payload artifacts, or local staging followed by C2-channel exfiltration.
  • Review blind spots in encrypted web traffic inspection, endpoint memory visibility, WMI logging, registry auditing, and file timestamp monitoring.
  • Use allowlists carefully for administrative tools and WMI usage; false positives are likely where IT management software performs legitimate discovery or remote administration.

Mitigation priorities

  • Harden and monitor Windows persistence surfaces, especially WMI event subscriptions and sensitive registry locations.
  • Ensure EDR or equivalent endpoint controls collect process, file, registry, WMI, and network context needed for incident reconstruction.
  • Restrict unnecessary outbound communications and monitor egress paths for C2, tool transfer, proxying, and exfiltration patterns.
  • Apply least privilege and privileged access monitoring to reduce the value of captured credentials or user input.
  • Protect sensitive data locations with access monitoring and data-loss controls to detect local collection and staging before exfiltration.
Additional notes and limits

ATT&CK identifies metaMain as a Windows backdoor used by Metador for long-term access and as a mechanism to decrypt Mafalda into memory. The relationship set provides broad behavioral context across discovery, collection, credential access, stealth, persistence, command-and-control, tool transfer, and exfiltration. Because official detection guidance is not provided, defensive value comes from validating telemetry and analytics for the related techniques in the local environment.

This take uses only the supplied ATT&CK STIX fields, external references, and relationships. ATT&CK does not provide official detection text, aliases, labels, or object-level tactics for metaMain in the supplied data. Related techniques include platforms beyond Windows, but the malware object itself is supplied as Windows; environment-specific evidence is required before asserting exposure, compromise, or detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

metaMain

metaMain is a backdoor used by Metador to maintain long-term access to compromised machines; it has also been used to decrypt Mafalda into memory.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

28 rows
DomainIDNameRelationship / procedure
EnterpriseT1033System Owner/User Discovery

metaMain can collect the username from a compromised host.[2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

metaMain's module file has been encrypted via XOR.[2]

EnterpriseT1057Process Discovery

metaMain can enumerate the processes that run on the platform.[1][2]

EnterpriseT1074.001Local Data StagingSub-technique

metaMain has stored the collected system files in a working directory.[1][2]

EnterpriseT1095Non-Application Layer Protocol

metaMain can establish an indirect and raw TCP socket-based connection to the C2 server.[1][2]

EnterpriseT1546.003Windows Management Instrumentation Event SubscriptionSub-technique

metaMain registered a WMI event subscription consumer called "hard_disk_stat" to establish persistence.[1]

EnterpriseT1620Reflective Code Loading

metaMain has reflectively loaded a DLL to read, decrypt, and load an orchestrator file.[1]

EnterpriseT1112Modify Registry

metaMain can write the process ID of a target process into the `HKEY_LOCAL_MACHINE\SOFTWARE\DDE\tpid` Registry value as part of its reflective loading activity.[2]

EnterpriseT1140Deobfuscate/Decode Files or Information

metaMain can decrypt and load other modules.[1]

EnterpriseT1560.003Archive via Custom MethodSub-technique

metaMain has used XOR-based encryption for collected files before exfiltration.[1]

EnterpriseT1056Input Capture

metaMain can log mouse events.[2]

EnterpriseT1106Native API

metaMain can execute an operator-provided Windows command by leveraging functions such as `WinExec`, `WriteFile`, and `ReadFile`.[1][2]

EnterpriseT1113Screen Capture

metaMain can take and save screenshots.[1][2]

EnterpriseT1071.001Web ProtocolsSub-technique

metaMain can use HTTP for C2 communications.[1][2]

EnterpriseT1497.003Time Based ChecksSub-technique

metaMain has delayed execution for five to six minutes during its persistence establishment process.[2]

EnterpriseT1005Data from Local System

metaMain can collect files and system information from a compromised host.[1][2]

EnterpriseT1083File and Directory Discovery

metaMain can recursively enumerate files in an operator-provided directory.[1][2]

EnterpriseT1041Exfiltration Over C2 Channel

metaMain can upload collected files and data to its C2 server.[2]

EnterpriseT1090.001Internal ProxySub-technique

metaMain can create a named pipe to listen for and send data to a named pipe-based C2 server.[2]

EnterpriseT1574.001DLLSub-technique

metaMain can support an HKCMD sideloading start method.[2]

EnterpriseT1105Ingress Tool Transfer

metaMain can download files onto compromised systems.[1][2]

EnterpriseT1070.004File DeletionSub-technique

metaMain has deleted collected items after uploading the content to its C2 server.[1][2]

EnterpriseT1056.001KeyloggingSub-technique

metaMain has the ability to log keyboard events.[1][2]

EnterpriseT1573.001Symmetric CryptographySub-technique

metaMain can encrypt the data that it sends and receives from the C2 server using an RC4 encryption algorithm.[1][2]

EnterpriseT1070.006TimestompSub-technique

metaMain can change the `CreationTime`, `LastAccessTime`, and `LastWriteTime` file time attributes when executed with `SYSTEM` privileges.[2]

EnterpriseT1055Process Injection

metaMain can inject the loader file, Speech02.db, into a process.[1]

EnterpriseT1205.001Port KnockingSub-technique

metaMain has authenticated itself to a different implant, Cryshell, through a port knocking and handshake procedure.[1]

EnterpriseT1082System Information Discovery

metaMain can collect the computer name from a compromised host.[2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1013: Metador

Metador is a suspected cyber espionage group that was first reported in September 2022. Metador has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group Metador based on the "I am meta" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1546.003: Windows Management Instrumentation Event SubscriptionEnterpriseuses · TechniqueT1620: Reflective Code LoadingEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1560.003: Archive via Custom MethodEnterpriseuses · TechniqueT1056: Input CaptureEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1090.001: Internal ProxyEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · GroupG1013: MetadorEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1056.001: KeyloggingEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
03c6eb450a721f71...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle03c6eb450a72…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  2. [2]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  3. [3]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  4. [4]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  5. [5]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  6. [6]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  7. [7]
    mitre-attackS1059
    Open source URL
  8. [8]
    mitre-attackS1059
    Open source URL
  9. [9]
    mitre-attackS1059
    Open source URL
  10. [10]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  11. [11]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  12. [12]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  13. [13]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  14. [14]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  15. [15]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  16. [16]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  17. [17]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  18. [18]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  19. [19]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  20. [20]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  21. [21]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  22. [22]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  23. [23]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  24. [24]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  25. [25]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  26. [26]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  27. [27]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  28. [28]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  29. [29]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  30. [30]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  31. [31]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  32. [32]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  33. [33]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  34. [34]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  35. [35]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  36. [36]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  37. [37]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  38. [38]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  39. [39]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  40. [40]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  41. [41]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  42. [42]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  43. [43]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  44. [44]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  45. [45]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  46. [46]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  47. [47]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  48. [48]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  49. [49]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  50. [50]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  51. [51]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  52. [52]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  53. [53]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  54. [54]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  55. [55]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  56. [56]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  57. [57]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  58. [58]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  59. [59]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  60. [60]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  61. [61]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  62. [62]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  63. [63]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  64. [64]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  65. [65]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  66. [66]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  67. [67]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  68. [68]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  69. [69]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  70. [70]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  71. [71]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  72. [72]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  73. [73]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  74. [74]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  75. [75]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  76. [76]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  77. [77]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  78. [78]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  79. [79]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  80. [80]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  81. [81]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  82. [82]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  83. [83]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  84. [84]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  85. [85]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use