Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Metador · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

Metador

MITRE G1013 ↗

Metador — ATT&CK roseME

attack rose · 9 techniques across 5 tactics

Analyst brief

misp-galaxy + mitre-attack

Metador primarily targets telecommunications, internet service providers, and universities in several countries in the Middle East and Africa. Metador’s attack chains are designed to bypass native security solutions while deploying malware platforms directly into memory. SentinelLabs researchers discovered variants of two long-standing Windows malware platforms, and indications of an additional Linux implant.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

9 techniques · 5 of 15 tactics

  1. Resource development

    2 techniques

  2. Execution

    1 technique

  3. Privilege escalation

    1 technique

  4. Stealth

    2 techniques

  5. Command and control

    3 techniques

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
metaMainS1059 ↗
MafaldaS1060 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

4 sources
  1. 1.sentinelone.com/labs/the-mystery-of-metador-unpicking-mafaldas-anti-an…
  2. 2.sentinelone.com/labs/the-mystery-of-metador-an-unattributed-threat-hid…
  3. 3.attack.mitre.org/groups/G1013
  4. 4.assets.sentinelone.com/sentinellabs22/metador

Track Metador on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.