LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1122: Mispadu

Mispadu is a banking trojan written in Delphi that was first observed in 2019 and uses a Malware-as-a-Service (MaaS) business model.[1][2] This malware is operated, managed, and sold by the Malteiro cybercriminal group.[2] Mispadu has mainly been used to target victims in Brazil and Mexico, and has also had confirmed operations throughout Latin America and Europe.[2][3][4]

EnterpriseS1122MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Mispadu matters because it is a Windows banking trojan associated with credential and user-data theft behaviors, not just commodity malware. ATT&CK ties it to Malteiro and a MaaS model, which makes the business concern repeatability: defenders should assume variants or operators may change delivery details while keeping recognizable behaviors such as malicious-file execution, browser/credential collection, persistence, obfuscation, and C2-based exfiltration.

Executive priority

Prioritize this as an identity, fraud, and endpoint-resilience risk where Windows users handle banking, payment, customer, or privileged web sessions—especially if the organization has exposure in Latin America or Europe as noted by ATT&CK sources. Leadership should ask whether SOC and IR teams can prove visibility into browser credential access, keylogging/screen/clipboard collection, persistence via Run keys or startup folders, and suspicious use of trusted Windows binaries such as msiexec.exe and rundll32.exe.

Technical view

ATT&CK does not provide a Mispadu-specific detection section, so coverage should be validated through the linked behaviors. On Windows, test whether endpoint telemetry captures malicious-file execution, Visual Basic execution, proxy execution through Msiexec and Rundll32, process injection, encoded/encrypted artifacts and subsequent decoding, discovery of processes/system/security tools/browser data, browser extension persistence, Registry Run key/startup folder persistence, collection from keystrokes/GUI prompts/screens/clipboard, credential access from password stores and browsers, and exfiltration over an existing C2 channel.

Likely telemetry

  • Windows process creation, parent/child process lineage, command-line arguments, and signed binary execution context
  • Endpoint file events for newly created, encoded, decoded, or suspicious executable/script artifacts
  • Registry Run key and Startup folder modification events
  • Browser extension inventory and browser profile/configuration change events
  • File access to browser data, password stores, and local credential-related locations

Detection direction

  • Do not rely on single indicators; MaaS and obfuscation relationships mean filenames, encodings, and infrastructure may change.
  • Correlate user-opened file execution with VB, msiexec.exe, rundll32.exe, decode/deobfuscation activity, or unexpected network connections.
  • Tune Msiexec and Rundll32 analytics carefully because both have legitimate administrative and installer uses; prioritize unusual parent processes, remote or uncommon payload locations, and follow-on credential or collection behavior.
  • Validate detections for browser-focused activity: browser information discovery, extension abuse, browser credential access, and access to saved password stores.
  • Look for behavior chains: discovery of security tools or system details, process injection, persistence changes, collection activity, then outbound C2-channel data movement.

Mitigation priorities

  • Reduce malicious-file execution risk with email/web filtering, attachment controls, user reporting workflows, and safe execution policies.
  • Harden Windows endpoints by restricting unnecessary script execution and monitoring or controlling abuse-prone signed binaries where operationally feasible.
  • Govern browser extensions and browser credential storage; reduce reliance on saved browser passwords for sensitive accounts.
  • Enforce credential protections such as MFA and least privilege, recognizing that keylogging and GUI input capture can still create session and fraud risk.
  • Monitor and protect persistence locations including Registry Run keys and Startup folders.
Additional notes and limits

The supplied ATT&CK object identifies Mispadu as a Delphi Windows banking trojan first observed in 2019, operated and sold by Malteiro under a MaaS model, with reported targeting mainly in Brazil and Mexico and confirmed operations across Latin America and Europe. The most useful defensive value comes from the ATT&CK relationships to techniques rather than from a malware-specific detection write-up, which is not provided.

No official detection text, aliases, labels, or explicit malware-level tactics are supplied. This take does not assert current activity, customer exposure, or guaranteed detection. Local validation is required to determine whether the organization collects the telemetry needed for the related ATT&CK techniques.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Mispadu

Mispadu is a banking trojan written in Delphi that was first observed in 2019 and uses a Malware-as-a-Service (MaaS) business model.[1][2] This malware is operated, managed, and sold by the Malteiro cybercriminal group.[2] Mispadu has mainly been used to target victims in Brazil and Mexico, and has also had confirmed operations throughout Latin America and Europe.[2][3][4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

26 rows
DomainIDNameRelationship / procedure
EnterpriseT1140Deobfuscate/Decode Files or Information

Mispadu decrypts its encrypted configuration files prior to execution.[2][1]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

Mispadu can steal credentials from Google Chrome.[2][1][5]

EnterpriseT1113Screen Capture

Mispadu has the ability to capture screenshots on compromised hosts.[2][3][1][5]

EnterpriseT1218.007MsiexecSub-technique

Mispadu has been installed via MSI installer.[2][1]

EnterpriseT1614.001System Language DiscoverySub-technique

Mispadu checks and will terminate execution if the compromised system’s language ID is not Spanish or Portuguese.[4][2]

EnterpriseT1176.001Browser ExtensionsSub-technique

Mispadu utilizes malicious Google Chrome browser extensions to steal financial data.[1]

EnterpriseT1217Browser Information Discovery

Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.[4][2]

EnterpriseT1566.002Spearphishing LinkSub-technique

Mispadu has been spread via malicious links embedded in emails.[2]

EnterpriseT1082System Information Discovery

Mispadu collects the OS version, computer name, and language ID.[1]

EnterpriseT1204.002Malicious FileSub-technique

Mispadu has relied on users to execute malicious files in order to gain execution on victim machines.[1][5][2]

EnterpriseT1106Native API

Mispadu has used a variety of Windows API calls, including ShellExecute and WriteProcessMemory.[4][2]

EnterpriseT1218.011Rundll32Sub-technique

Mispadu uses RunDLL32 for execution via its injector DLL.[1]

EnterpriseT1056.001KeyloggingSub-technique

Mispadu can log keystrokes on the victim's machine.[1][5][3]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Mispadu creates a link in the startup folder for persistence.[1] Mispadu adds persistence via the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.[5]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Mispadu uses a custom algorithm to obfuscate its internal strings and uses hardcoded keys.[1]

Mispadu also uses encoded configuration files and has encoded payloads using Base64.[1][2][6]

EnterpriseT1055Process Injection

Mispadu's binary is injected into memory via `WriteProcessMemory`.[4][2]

EnterpriseT1518.001Security Software DiscoverySub-technique

Mispadu can list installed security products in the victim’s environment.[1][5]

EnterpriseT1056.002GUI Input CaptureSub-technique

Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.[4][2]

EnterpriseT1057Process Discovery

Mispadu can enumerate the running processes on a compromised host.[1]

EnterpriseT1497.001System ChecksSub-technique

Mispadu can run checks to verify if it is running within a virtualized environments including Hyper-V, VirtualBox or VMWare and will terminate execution if the computer name is “JOHN-PC.”[1][2]

EnterpriseT1083File and Directory Discovery

Mispadu searches for various filesystem paths to determine what banking applications are installed on the victim’s machine.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Mispadu can sends the collected financial data to the C2 server.[1][2]

EnterpriseT1573.002Asymmetric CryptographySub-technique

Mispadu contains a copy of the OpenSSL library to encrypt C2 traffic.[4]

EnterpriseT1115Clipboard Data

Mispadu has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.[1]

EnterpriseT1555Credentials from Password Stores

Mispadu has obtained credentials from mail clients via NirSoft MailPassView.[2][4][1]

EnterpriseT1059.005Visual BasicSub-technique

Mispadu’s dropper uses VBS files to install payloads and perform execution.[2][1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1026: Malteiro

Malteiro is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the Mispadu banking trojan via a Malware-as-a-Service (MaaS) business model. Malteiro mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1218.007: MsiexecEnterpriseuses · TechniqueT1614.001: System Language DiscoveryEnterpriseuses · TechniqueT1176.001: Browser ExtensionsEnterpriseuses · TechniqueT1217: Browser Information DiscoveryEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · GroupG1026: MalteiroEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1056.002: GUI Input CaptureEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
5d74ee1f3461b4a0...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle5d74ee1f3461…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  2. [2]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  3. [3]
    SCILabs URSA/Mispadu Evolution 2023

    SCILabs. (2023, May 23). Evolution of banking trojan URSA/Mispadu. Retrieved March 13, 2024.

    Open source URL
  4. [4]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  5. [5]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  6. [6]
    SCILabs Malteiro Threat Overlap 2023

    SCILabs. (2023, October 8). URSA/Mispadu: Overlap analysis with other threats. Retrieved March 13, 2024.

    Open source URL
  7. [7]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  8. [8]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  9. [9]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  10. [10]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  11. [11]
    SCILabs URSA/Mispadu Evolution 2023

    SCILabs. (2023, May 23). Evolution of banking trojan URSA/Mispadu. Retrieved March 13, 2024.

    Open source URL
  12. [12]
    SCILabs URSA/Mispadu Evolution 2023

    SCILabs. (2023, May 23). Evolution of banking trojan URSA/Mispadu. Retrieved March 13, 2024.

    Open source URL
  13. [13]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  14. [14]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  15. [15]
    mitre-attackS1122
    Open source URL
  16. [16]
    mitre-attackS1122
    Open source URL
  17. [17]
    mitre-attackS1122
    Open source URL
  18. [18]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  19. [19]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  20. [20]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  21. [21]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  22. [22]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  23. [23]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  24. [24]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  25. [25]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  26. [26]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  27. [27]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  28. [28]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  29. [29]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  30. [30]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  31. [31]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  32. [32]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  33. [33]
    SCILabs URSA/Mispadu Evolution 2023

    SCILabs. (2023, May 23). Evolution of banking trojan URSA/Mispadu. Retrieved March 13, 2024.

    Open source URL
  34. [34]
    SCILabs URSA/Mispadu Evolution 2023

    SCILabs. (2023, May 23). Evolution of banking trojan URSA/Mispadu. Retrieved March 13, 2024.

    Open source URL
  35. [35]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  36. [36]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  37. [37]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  38. [38]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  39. [39]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  40. [40]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  41. [41]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  42. [42]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  43. [43]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  44. [44]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  45. [45]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  46. [46]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  47. [47]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  48. [48]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  49. [49]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  50. [50]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  51. [51]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  52. [52]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  53. [53]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  54. [54]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  55. [55]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  56. [56]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  57. [57]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  58. [58]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  59. [59]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  60. [60]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  61. [61]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  62. [62]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  63. [63]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  64. [64]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  65. [65]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  66. [66]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  67. [67]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  68. [68]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  69. [69]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  70. [70]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  71. [71]
    SCILabs URSA/Mispadu Evolution 2023

    SCILabs. (2023, May 23). Evolution of banking trojan URSA/Mispadu. Retrieved March 13, 2024.

    Open source URL
  72. [72]
    SCILabs URSA/Mispadu Evolution 2023

    SCILabs. (2023, May 23). Evolution of banking trojan URSA/Mispadu. Retrieved March 13, 2024.

    Open source URL
  73. [73]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  74. [74]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  75. [75]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  76. [76]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  77. [77]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  78. [78]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  79. [79]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  80. [80]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  81. [81]
    SCILabs Malteiro Threat Overlap 2023

    SCILabs. (2023, October 8). URSA/Mispadu: Overlap analysis with other threats. Retrieved March 13, 2024.

    Open source URL
  82. [82]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  83. [83]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  84. [84]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  85. [85]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  86. [86]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  87. [87]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  88. [88]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  89. [89]
    Metabase Q Mispadu Trojan 2023

    Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.

    Open source URL
  90. [90]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  91. [91]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  92. [92]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  93. [93]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  94. [94]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  95. [95]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  96. [96]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  97. [97]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  98. [98]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  99. [99]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  100. [100]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  101. [101]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  102. [102]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  103. [103]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  104. [104]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  105. [105]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  106. [106]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  107. [107]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  108. [108]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  109. [109]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  110. [110]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  111. [111]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
  112. [112]
    Segurança Informática URSA Sophisticated Loader 2020

    Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.

    Open source URL
  113. [113]
    ESET Security Mispadu Facebook Ads 2019

    ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.

    Open source URL
  114. [114]
    SCILabs Malteiro 2021

    SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use