LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1060: Mafalda

Mafalda is a flexible interactive implant that has been used by Metador. Security researchers assess the Mafalda name may be inspired by an Argentinian cartoon character that has been popular as a means of political commentary since the 1960s. [1]

EnterpriseS1060MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Mafalda matters because it is described as a flexible interactive Windows implant associated in ATT&CK with Metador, a suspected espionage group. The linked behaviors show a post-compromise toolset pattern: discover the host and network, access credentials from LSASS, capture user input or screens, stage and collect local data, and communicate or exfiltrate over command-and-control channels. For leaders, this is less about one malware name and more about whether Windows endpoint, identity, and network controls can prove they would notice an interactive operator moving from discovery to credential access and data collection.

Executive priority

Prioritize Mafalda as a validation case for resilience against hands-on-keyboard intrusion on Windows systems. The business questions are: can the organization detect credential access against LSASS, unusual command shell or PowerShell activity, registry changes, internal proxying, tool transfer, and data staging before sensitive data leaves over C2? This object is especially relevant to incident response readiness, SOC telemetry quality, identity risk reduction, and evidence that endpoint and network monitoring cover post-compromise behavior rather than only known malware signatures.

Technical view

ATT&CK does not provide a dedicated detection section for Mafalda, so defenders should validate coverage through the related techniques. Focus on Windows telemetry for LSASS memory access, PowerShell and cmd execution, registry query and modification, native API-driven process behavior, process/user/system/network discovery, file and directory enumeration, local data staging, screen capture, input capture indicators, ingress tool transfer, internal proxy behavior, web-protocol C2, non-application-layer C2, standard encoding, and exfiltration over the existing C2 channel. Treat the Metador relationship as context, not proof of attribution in local incidents.

Likely telemetry

  • Windows endpoint detection and response events for process creation, parent-child process relationships, command-line arguments, and suspicious native API behavior
  • Windows security and system logs relevant to credential access, privilege context, and process access to LSASS
  • PowerShell logging where enabled, including script block, module, and command history evidence
  • Registry access and modification telemetry for query and persistence or defense-impairment patterns
  • File system telemetry for enumeration, creation of staging locations, encoded or encrypted files, and tool transfer artifacts

Detection direction

  • Map detections to the related ATT&CK techniques rather than relying on the Mafalda name, because official detection guidance is not provided.
  • Validate high-fidelity alerts for LSASS access and credential material exposure, with tuning for legitimate administrative and security tools.
  • Review PowerShell and Windows Command Shell detections for discovery, collection, staging, and transfer patterns, while accounting for normal administrator activity.
  • Correlate host discovery commands, registry queries, process discovery, network connection discovery, and file enumeration into multi-event intrusion narratives instead of isolated low-severity alerts.
  • Inspect network monitoring for web-protocol C2, encoded content, non-application-layer communications, internal proxy behavior, and exfiltration over an established C2 channel.

Mitigation priorities

  • Harden Windows credential protections around LSASS and restrict administrative privileges that enable credential dumping.
  • Improve PowerShell and command shell governance through logging, constrained use where appropriate, and review of administrative baselines.
  • Strengthen registry monitoring and change-control processes for keys relevant to persistence, execution, and defense impairment.
  • Limit unnecessary outbound communications and monitor egress paths that could support C2, tool transfer, internal proxying, or exfiltration.
  • Reduce data exposure by controlling local sensitive data storage and monitoring unusual staging or collection behavior.
Additional notes and limits

The supplied ATT&CK object identifies Mafalda as a Windows malware implant used by Metador and provides many technique relationships, but no official detection text. The strongest defensive value is to use these relationships as a coverage checklist for SOC engineering, threat hunting, and IR tabletop validation.

This take does not assert current exploitation, customer exposure, or guaranteed detection. Several related techniques have broad platform descriptions in ATT&CK, but the Mafalda object itself lists Windows as its platform. Local telemetry, asset criticality, administrative baselines, and confirmed indicators are required for environment-specific assessment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Mafalda

Mafalda is a flexible interactive implant that has been used by Metador. Security researchers assess the Mafalda name may be inspired by an Argentinian cartoon character that has been popular as a means of political commentary since the 1960s. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

36 rows
DomainIDNameRelationship / procedure
EnterpriseT1205.001Port KnockingSub-technique

Mafalda can use port-knocking to authenticate itself to another implant called Cryshell to establish an indirect connection to the C2 server.[1][2]

EnterpriseT1134.003Make and Impersonate TokenSub-technique

Mafalda can create a token for a different user.[2]

EnterpriseT1133External Remote Services

Mafalda can establish an SSH connection from a compromised host to a server.[2]

EnterpriseT1685.005Clear Windows Event LogsSub-technique

Mafalda can delete Windows Event logs by invoking the `OpenEventLogW` and `ClearEventLogW` functions.[1]

EnterpriseT1132.001Standard EncodingSub-technique

Mafalda can encode data using Base64 prior to exfiltration.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

Mafalda can execute shell commands using `cmd.exe`.[2]

EnterpriseT1112Modify Registry

Mafalda can manipulate the system registry on a compromised host.[2]

EnterpriseT1552.004Private KeysSub-technique

Mafalda can collect a Chrome encryption key used to protect browser cookies.[1]

EnterpriseT1569.002Service ExecutionSub-technique

Mafalda can create a remote service, let it run once, and then delete it.[2]

EnterpriseT1095Non-Application Layer Protocol

Mafalda can use raw TCP for C2.[1]

EnterpriseT1074.001Local Data StagingSub-technique

Mafalda can place retrieved files into a destination directory.[1]

EnterpriseT1005Data from Local System

Mafalda can collect files and information from a compromised host.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Mafalda can decrypt files and data.[1]

EnterpriseT1059.001PowerShellSub-technique

Mafalda can execute PowerShell commands on a compromised machine.[2]

EnterpriseT1090.001Internal ProxySub-technique

Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.[2]

EnterpriseT1057Process Discovery

Mafalda can enumerate running processes on a machine.[1]

EnterpriseT1056Input Capture

Mafalda can conduct mouse event logging.[2]

EnterpriseT1071.001Web ProtocolsSub-technique

Mafalda can use HTTP for C2.[1]

EnterpriseT1049System Network Connections Discovery

Mafalda can use the GetExtendedTcpTable function to retrieve information about established TCP connections.[1]

EnterpriseT1012Query Registry

Mafalda can enumerate Registry keys with all subkeys and values.[2]

EnterpriseT1217Browser Information Discovery

Mafalda can collect the contents of the `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\LocalState` file.[1]

EnterpriseT1113Screen Capture

Mafalda can take a screenshot of the target machine and save it to a file.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Mafalda can send network system data and files to its C2 server.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

Mafalda can encrypt its C2 traffic with RC4.[1]

EnterpriseT1082System Information Discovery

Mafalda can collect the computer name of a compromised host.[1][2]

EnterpriseT1105Ingress Tool Transfer

Mafalda can download additional files onto the compromised host.[2]

EnterpriseT1016System Network Configuration Discovery

Mafalda can use the `GetAdaptersInfo` function to retrieve information about network adapters and the `GetIpNetTable` function to retrieve the IPv4 to physical network address mapping table.[1]

EnterpriseT1033System Owner/User Discovery

Mafalda can collect the username from a compromised host.[2]

EnterpriseT1680Local Storage Discovery

Mafalda can enumerate all drives on a compromised host.[1][2]

EnterpriseT1134Access Token Manipulation

Mafalda can use `AdjustTokenPrivileges()` to elevate privileges.[2]

EnterpriseT1106Native API

Mafalda can use a variety of API calls.[1]

EnterpriseT1083File and Directory Discovery

Mafalda can search for files and directories.[1]

EnterpriseT1622Debugger Evasion

Mafalda can search for debugging tools on a compromised host.[2]

EnterpriseT1518.001Security Software DiscoverySub-technique

Mafalda can search for a variety of security software programs, EDR systems, and malware analysis tools.[1][2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Mafalda has been obfuscated and contains encrypted functions.[1]

EnterpriseT1003.001LSASS MemorySub-technique

Mafalda can dump password hashes from `LSASS.exe`.[2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1013: Metador

Metador is a suspected cyber espionage group that was first reported in September 2022. Metador has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group Metador based on the "I am meta" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1205.001: Port KnockingEnterpriseuses · TechniqueT1134.003: Make and Impersonate TokenEnterpriseuses · TechniqueT1133: External Remote ServicesEnterpriseuses · TechniqueT1685.005: Clear Windows Event LogsEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1552.004: Private KeysEnterpriseuses · TechniqueT1569.002: Service ExecutionEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1090.001: Internal ProxyEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1056: Input CaptureEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1217: Browser Information DiscoveryEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
a42b5039b3df6ea9...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundlea42b5039b3df…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  2. [2]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  3. [3]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  4. [4]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  5. [5]
    mitre-attackS1060
    Open source URL
  6. [6]
    mitre-attackS1060
    Open source URL
  7. [7]
    mitre-attackS1060
    Open source URL
  8. [8]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  9. [9]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  10. [10]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  11. [11]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  12. [12]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  13. [13]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  14. [14]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  15. [15]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  16. [16]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  17. [17]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  18. [18]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  19. [19]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  20. [20]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  21. [21]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  22. [22]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  23. [23]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  24. [24]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  25. [25]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  26. [26]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  27. [27]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  28. [28]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  29. [29]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  30. [30]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  31. [31]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  32. [32]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  33. [33]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  34. [34]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  35. [35]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  36. [36]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  37. [37]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  38. [38]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  39. [39]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  40. [40]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  41. [41]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  42. [42]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  43. [43]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  44. [44]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  45. [45]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  46. [46]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  47. [47]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  48. [48]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  49. [49]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  50. [50]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  51. [51]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  52. [52]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  53. [53]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  54. [54]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  55. [55]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  56. [56]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  57. [57]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  58. [58]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  59. [59]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  60. [60]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  61. [61]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  62. [62]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  63. [63]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  64. [64]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  65. [65]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  66. [66]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  67. [67]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  68. [68]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  69. [69]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  70. [70]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  71. [71]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  72. [72]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  73. [73]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  74. [74]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  75. [75]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  76. [76]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  77. [77]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  78. [78]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  79. [79]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  80. [80]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  81. [81]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  82. [82]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  83. [83]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  84. [84]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  85. [85]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  86. [86]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  87. [87]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  88. [88]
    SentinelLabs Metador Sept 2022

    Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.

    Open source URL
  89. [89]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use