Threat Actor

Machete

Also known as: Machete, APT-C-43, El Machete

Machete is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010. It has primarily focused its operations within Latin America, with a particular emphasis on Venezuela, but also in the US, Europe, Russia, and parts of Asia. Machete generally targets high-profile organizations such as government institutions, intelligence services, and military units, as well as telecommunications and power companies.

11
Techniques
1
Software
0
indicators on this record

Properties

Last source
MITRE ATT&CK
STIX ID
intrusion-set--38863958-a201-4ce1-9dbe-539b0b6804e0
In Signal since
initial import (Sep 2026)
Retrieved at
2026-11-01T16:36:58+00:00
Type
intrusion-set

MITRE ATT&CK Techniques (11)

▸
Drive-by Compromise (T1189)

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

▸
Malicious File (T1204.002)

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

▸
Malicious Link (T1204.001)

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl

▸
Match Legitimate Resource Name or Location (T1036.005)

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

▸
Msiexec (T1218.007)

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is t

▸
Python (T1059.006)

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform

▸
Scheduled Task (T1053.005)

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple w

▸
Spearphishing Attachment (T1566.001)

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

▸
Spearphishing Link (T1566.002)

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specifi

▸
Visual Basic (T1059.005)

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows techn

▸
Windows Command Shell (T1059.003)

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima

Software & Tools (1)

▸
Machete [malware]

Machete is a cyber espionage toolset used by Machete. It is a Pyth

Explore this actor's full graph with Ninja Signal

Machete — Threat Actor Profile — Ninja Signal | Ninja Signal