Metador is a threat actor known for targeting telecoms and universities in the Middle East and Africa with custom in-memory malware platforms.
Metador is a threat actor targeting telecommunications, ISPs, and universities primarily in the Middle East and Africa. The actor deploys custom malware platforms like metaMain and Mafalda directly into memory to bypass native security solutions. Their key TTPs include privilege escalation via WMI event subscriptions, C2 over Web Protocols and Non-Application Layer Protocols, and stealth using encrypted files and file deletion. Defenders should focus on monitoring anomalous memory operations, unusual WMI subscriptions, and suspicious web-based C2 traffic.
Metador primarily targets telecommunications, internet service providers, and universities in several countries in the Middle East and Africa. Metador’s attack chains are designed to bypass native security solutions while deploying malware platforms directly into memory. SentinelLabs researchers discovered variants of two long-standing Windows malware platforms, and indications of an additional Linux implant.
Monitor for suspicious activities related to obtaining or creating malware and tools, and implement controls against their use.
Monitor for suspicious commands executed via Windows Command Shell and implement endpoint controls to prevent them.
Monitor for suspicious activities related to Windows Management Instrumentation Event Subscription and implement controls against privilege escalation.
Monitor for encrypted or encoded files and deleted files, and implement measures to detect and prevent them.
Monitor for suspicious network activity using non-application layer protocols and web protocols, and implement network controls to prevent them.
Metador primarily targets telecommunications, ISPs, and universities in the Middle East and Africa.
Metador bypasses native security solutions by using custom malware platforms like metaMain and Mafalda that operate directly in memory.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.