🇻🇪

El Machete

APT Group Information theft and espionage 5 zero-day CVEs ETDA ✓

Also Known As 4 names

APT-C-43 G0095 Machete machete-apt

Target Countries 29

Countries highlighted in red

Argentina Belgium Plurinational State of Bolivia Brazil Canada Chile China Colombia Cuba Germany Dominican Republic Ecuador Spain France United Kingdom Guatemala Israel Republic of Korea Mexico Malaysia Nicaragua Peru Pakistan Russian Federation Saudi Arabia Sweden Ukraine United States Bolivarian Republic of Venezuela

Sectors Targeted

Embassies Public Administration 92 Telecommunications Arts, Entertainment, and Recreation 71 Utilities 22 Educational Services 61 Government Commercial Banking 52211 Military Energy Defense Telecommunications 517 Finance and Insurance 52 National Security and International Affairs 928 Education

Details

Origin 🇻🇪 VE

Last Updated 01 Jun 2022

Malware Families 4

lokirat

elmachete_dropper_2022

pyark

Loki RAT

MITRE ATT&CK 96

T1003 T1005 T1007 T1008 T1011 T1012 T1016 T1021 T1027 - Obfuscated Files or Information T1033 T1036 T1036.005 T1041 T1047 T1048 T1049 T1053 T1053.005 T1055 T1057 T1059 T1059.001 T1059.003 T1059.005 T1059.006 T1060 T1070 T1071 T1071.001 T1078 T1081 T1082 T1083 T1085 T1087 T1090 T1095 T1102 T1105 T1106 T1110 T1112 T1114 T1114.001 T1115 T1119 T1120 T1124 T1127 T1130 T1132 T1133 T1136 T1137 T1140 - Deobfuscate/Decode Files or Information T1170 T1176 T1189 T1190 T1204 - User Execution T1204.001 T1204.002 T1217 T1218 - Signed Binary Proxy Execution T1218.007 T1485 T1486 T1489 T1490 - Inhibit System Recovery T1497 T1497.003 T1498 - Network Denial of Service T1503 T1518 T1529 T1530 T1531 T1539 T1543 T1547 T1550 T1552 T1553 - Subvert Trust Controls T1555 T1560 T1561 T1562 T1562.001 T1566 - Phishing T1566.001 T1566.002 T1571 T1573 T1583 T1587 T1595

Related Zero-Days 5

CVE-2018-8174 CVE-2020-1472 CVE-2022-42475 CVE-2023-36884 CVE-2023-38831

Known Names 6 entries

El Machete Kaspersky

TEMP.Andromeda FireEye

APT-C-43 Qihooo 360

ATK 97 Thales

TAG-NS1 Recorded Future

G0095 MITRE

Observed Target Countries 26

Based on ETDA data — countries highlighted in red

Argentina Belgium Bolivia Brazil Canada China Colombia Cuba Dominican Republic Ecuador France Germany Guatemala Malaysia Mexico Nicaragua Peru Russia South Korea Spain Sweden UK Ukraine USA Venezuela others

Description

(Kaspersky) “Machete” is a targeted attack campaign with Spanish speaking roots. We believe this campaign started in 2010 and was renewed with an improved infrastructure in 2012. The operation may be still “active”. The malware is distributed via social engineering techniques, which includes spear-phishing emails and infections via Web by a fake Blog website. We have found no evidence of exploits targeting zero-day vulnerabilities. Both the attackers and the victims appear to be Spanish-speaking. In some cases, such as Russia, the target appears to be an embassy from one of the countries of this list.

Tools Used 4

LokiBot Machete Pyark Living off the Land

Operations 4

2017-03 We’ve found that this group has continued to operate successfully, predominantly in Latin America, since 2014. All attackers simply moved to new C2 infrastructure, based largely around dynamic DNS domains, in addition to making minimal changes to the malware in order to evade signature-based detection. https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html

2019-03 From the end of March up until the end of May 2019, ESET researchers observed that there were more than 50 victimized computers actively communicating with the C&C server. This amounts to gigabytes of data being uploaded every week. https://www.welivesecurity.com/2019/08/05/sharpening-machete-cyberespionage/

2020-06 Operation “HpReact” In June 2020, 360 Security Center discovered a new backdoor Pyark written in Python by the fileless attack protection function. https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/

2022-03 In mid-March, El Machete was spotted sending spear-phishing emails to financial organizations in Nicaragua, with an attached Word document titled “Dark plans of the neo-Nazi regime in Ukraine.” https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/

Reports & References 1

https://securelist.com/el-machete/66108/

ETDA Profile

El Machete

Origin

[Unknown]

First Seen 2010

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0095/

View on ETDA APT Groups ↗