Threat Actor

Malteiro

Also known as: Malteiro

Malteiro is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the Mispadu banking trojan via a Malware-as-a-Service (MaaS) business model. Malteiro mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).

12
Techniques
1
Software
0
indicators on this record

Properties

Last source
MITRE ATT&CK
STIX ID
intrusion-set--bf668120-e9a6-4017-a014-bfc0f5232656
In Signal since
initial import (Sep 2026)
Retrieved at
2026-11-01T20:34:00+00:00
Type
intrusion-set

MITRE ATT&CK Techniques (12)

▸
Credentials from Password Stores (T1555)

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several

▸
Credentials from Web Browsers (T1555.003)

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web bro

▸
Deobfuscate/Decode Files or Information (T1140)

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

▸
Dynamic-link Library Injection (T1055.001)

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. D

▸
Encrypted/Encoded File (T1027.013)

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

▸
Financial Theft (T1657)

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own fina

▸
Malicious File (T1204.002)

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

▸
Security Software Discovery (T1518.001)

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a clo

▸
Spearphishing Attachment (T1566.001)

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

▸
System Information Discovery (T1082)

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and

▸
System Language Discovery (T1614.001)

Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This inf

▸
Visual Basic (T1059.005)

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows techn

Software & Tools (1)

▸
Mispadu [malware]

Mispadu is a banking trojan written in Delphi that was first observed in 2019 and uses a Malware-as-a-Servi

Explore this actor's full graph with Ninja Signal

Malteiro — Threat Actor Profile — Ninja Signal | Ninja Signal