Home / Threat actors / Metador

Metador G1013

🔔 Create alert

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

10

Techniques

2

Malware and tools

Metador is a suspected cyber espionage group that was first reported in September 2022. Metador has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group Metador based on the "I am meta" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1588.001 Malware T1588.002 Tool

Execution

T1059.003 Windows Command Shell

Persistence

T1546.003 Windows Management Instrumentation Event Subscription

Privilege Escalation

T1546.003 Windows Management Instrumentation Event Subscription

Stealth

T1027.013 Encrypted/Encoded File T1070.004 File Deletion

Command and Control

T1071.001 Web Protocols T1095 Non-Application Layer Protocol T1105 Ingress Tool Transfer

Malware and tools

MafaldaMalwareS1060
metaMainMalwareS1059

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.