Machete

Profile narrative

Machete is a cyber‑espionage threat actor also known by the alias Machete. Open‑source reporting indicates the group has been active since at least 2010 and has historically targeted a wide range of victims across multiple regions. The actor’s known location, when disclosed, is Spain. Beginning in 2019, Machete shifted its focus toward Latin American military entities, particularly in Venezuela and Ecuador. The primary objective observed in its operations is the collection of sensitive information.

The group’s typical initial access vector involves spear‑phishing emails that carry malicious attachments. These attachments are often genuine documents stolen from earlier compromises, such as radiogram files used for military communications. Opening the attachment triggers a backdoor trojan that establishes communication with the actor’s command‑and‑control infrastructure. ESET reported that, between March and May 2019, at least fifty infected machines contacted Machete’s C2 servers, with roughly seventy‑five percent of those located in Venezuela. The malware variant used in this period had been in use for over a year and differed from versions previously analyzed by Kaspersky in 2014 and Cylance in 2017.

During the 2019 campaign against the Venezuelan military, Machete exfiltrated specialized geographic information system files that detail navigation routes and military grid positions. More than half of the compromised devices belonged to the Venezuelan armed forces, and the operation also affected neighboring countries’ military organizations. The campaign represented a noticeable shift in the group’s targeting emphasis toward Latin America while retaining the core capabilities seen in earlier global operations.

Attribution to a specific state sponsor or criminal consortium has not been publicly established in the available sources. The only geographic detail provided is the possible base of operations in Spain, which is presented as a known location rather than a confirmed jurisdictional tie. Consequently, the actor’s affiliations remain unspecified in the open‑source record.

Incidents

Attributed incidents are available to members.