Description
[Malteiro](https://attack.mitre.org/groups/G1026) is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the [Mispadu](https://attack.mitre.org/software/S1122) banking trojan via a Malware-as-a-Service (MaaS) business model. [Malteiro](https://attack.mitre.org/groups/G1026) mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).(Citation: SCILabs Malteiro 2021)
Techniques Used (TTPs)
- T1204.002 — Malicious File (execution)
- T1555.003 — Credentials from Web Browsers (credential-access)
- T1055.001 — Dynamic-link Library Injection (defense-evasion, privilege-escalation)
- T1657 — Financial Theft (impact)
- T1082 — System Information Discovery (discovery)
- T1059.005 — Visual Basic (execution)
- T1027.013 — Encrypted/Encoded File (defense-evasion)
- T1518.001 — Security Software Discovery (discovery)
- T1566.001 — Spearphishing Attachment (initial-access)
- T1555 — Credentials from Password Stores (credential-access)
- T1140 — Deobfuscate/Decode Files or Information (defense-evasion)
- T1614.001 — System Language Discovery (discovery)
Total TTPs: 12
Malware & Tools
Malware: Mispadu