Machete

Introduction

Machete is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010. It has primarily focused its operations within Latin America, with a particular emphasis on Venezuela, but also in the US, Europe, Russia, and parts of Asia. Machete generally targets high-profile organizations such as government institutions, intelligence services, and military units, as well as telecommunications and power companies. Cylance Machete Mar 2017 Securelist Machete Aug 2014 ESET Machete July 2019 360 Machete Sep 2020

Activities and Tactics

Targeted Sectors: Military, Government

Country of Origin: 🏳️ Unknown

Incident Type: Espionage

Suspected Victims: Venezuela, Russia, Cuba, China, Belgium, Ecuador, Brazil, Spain, Germany, France…

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1204.002 Malicious File
• T1566.002 Spearphishing Link
• T1059.003 Windows Command Shell
• T1059.005 Visual Basic
• T1059.006 Python
• T1053.005 Scheduled Task
• T1036.005 Match Legitimate Resource Name or Location
• T1204.001 Malicious Link
• T1189 Drive-by Compromise
• T1566.001 Spearphishing Attachment
• T1218.007 Msiexec

ATT&CK technique IDs (denormalized)

• T1036.005
• T1053.005
• T1059.003
• T1059.005
• T1059.006
• T1189
• T1204.001
• T1204.002
• T1218.007
• T1566.001
• T1566.002

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• Machete (S0409) — malware

Attribution and Evidence

Country of Origin: Unknown Additional attribution information pending cataloguing.

References

[1] mitre-attack [5] Cylance Machete Mar 2017 The Cylance Threat Research Team. (2017, March 22). El Machete’s Malware Attacks Cut Through LATAM. Retrieved September 13, 2019. [6] Securelist Machete Aug 2014 Kaspersky Global Research and Analysis Team. (2014, August 20). El Machete. Retrieved September 13, 2019. [7] ESET Machete July 2019 ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019. [8] 360 Machete Sep 2020 kate. (2020, September 25). APT-C-43 steals Venezuelan military secrets to provide intelligence support for the reactionaries — HpReact campaign. Retrieved November 20, 2020.