Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · El Machete · Unknown · assessed origin Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

El Machete

  • Machete
  • machete-apt
  • APT-C-43
  • G0095

state sponsor · UnknownMITRE G0095 ↗

El Machete — ATT&CK roseEM

attack rose · 11 techniques across 3 tactics

Analyst brief

misp-galaxy + mitre-attack

El Machete is one of these threats that was first publicly disclosed and named by Kaspersky here. We’ve found that this group has continued to operate successfully, predominantly in Latin America, since 2014. All attackers simply moved to new C2 infrastructure, based largely around dynamic DNS domains, in addition to making minimal changes to the malware in order to evade signature-based detection.

Observed targets (as stated by the sources)

15 countries · 2 sectors
VenezuelaRussiaCubaChinaBelgiumEcuadorBrazilSpainGermanyFranceColombiaPeruSwedenUnited StatesMalaysia

assessed originnot stated by sourcesobserved targets · 15

countries · 15

  • Venezuela
  • Russia
  • Cuba
  • China
  • Belgium
  • Ecuador
  • Brazil
  • Spain
  • Germany
  • France
  • Colombia
  • Peru
  • Sweden
  • United States
  • Malaysia

sectors · 2

  • Military
  • Government

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

11 techniques · 3 of 15 tactics

  1. Initial access

    3 techniques

  2. Execution

    6 techniques

  3. Stealth

    2 techniques

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
MacheteS0409 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2014El MacheteKaspersky ↗

Take it with you

keyless · no signup

References

8 sources
  1. 1.attack.mitre.org/groups/G0095
  2. 2.securelist.com/el-machete/66108
  3. 3.cylance.com/en_us/blog/el-machete-malware-attacks-cut-through-lata…
  4. 4.cfr.org/interactive/cyber-operations/machete
  5. 5.threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-lata…
  6. 6.blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-prov…
  7. 7.attack.mitre.org/groups/G0095
  8. 8.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf

Track El Machete on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.