Malteiro
This group of cybercriminals is named Malteiroby SCILabs, they operate and distribute the URSA/Mispadu banking trojan.
techniques · ATT&CK
malware
Malteiro
Malteiro is a cybercriminal group tracked by SCILabs known for distributing the URSA/Mispadu banking trojan for financial theft.
Analyst brief
Malteiro is a financially motivated cybercriminal group tracked by SCILabs, distributing the URSA/Mispadu banking trojan. They primarily target individual users and customers of financial institutions. Their key TTPs include initial access via Spearphishing Attachment (T1566.001), execution through Visual Basic (T1059.005) scripts, stealth using Dynamic-link Library Injection (T1055.001) and Encrypted/Encoded Files (T1027.013), credential access from Web Browsers (T1555.003), and final Financial Theft (T1657). Defenders should focus on detecting malicious email attachments, anomalous VBA macro execution, unauthorized access to browser credential stores, and encoded file activity to prevent credential compromise.
unknown
Kill-chain playbook6
Monitor email attachments and their content to detect Spearphishing Attachment technique and block suspicious attachments.
Monitor Visual Basic scripts and malicious file execution, and block suspicious scripts and files.
Monitor file system and processes to detect Encrypted/Encoded Files and DLL Injection techniques, and block suspicious activity.
Monitor processes and file system to detect credential access from Password Stores and Web Browsers, and block suspicious activity.
Monitor System Information Discovery and Security Software Discovery, and block suspicious queries.
Monitor financial transactions and access to financial data to detect Financial Theft, and block suspicious activity.
FAQ2
What malware does the Malteiro group primarily use for financial theft?
The Malteiro group distributes and uses the URSA/Mispadu banking trojan.
What is the primary technique used by Malteiro for initial access to a target system?
Initial access is achieved via Spearphishing Attachment (T1566.001).
See also5
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.