Cyber Threat Actor: Machete

Machete is a cyber‑espionage group also known by its alias Machete and has been linked to operations originating from Spain. The group has been active since at least 2010 and historically targeted a broad range of victims worldwide. Beginning in 2019, Machete shifted its focus primarily to Venezuela, according to ESET observations. Besides Venezuela, the group has also conducted operations against neighboring countries, with the Ecuadorian military identified as a target. The strategic objective of Machete’s activities is espionage, specifically the collection of sensitive geographic information system files. Attackers seek data that detail military navigation routes and grid positions, as noted in ESET’s analysis. This focus on GIS information indicates an interest in operational planning and movement details of armed forces.

Machete gains initial access through spear‑phishing emails that contain malicious attachments. The attachments are legitimate documents stolen from earlier compromises, particularly radiograms used for military communications. When opened, these files deploy a backdoor trojan that establishes communication with the group’s command‑and‑control infrastructure. ESET reported that the malware version employed in the 2019 campaign had been in use for over a year and differed from variants seen in 2014 and 2017 analyses by Kaspersky and Cylance. Earlier versions of the trojan shared similar data‑theft capabilities but differed in delivery methods, code structure, and target selection. The 2019 operation against the Venezuelan military resulted in more than fifty infected computers contacting Machete’s servers, with roughly three quarters located in Venezuela and over half belonging to the nation’s armed forces. Similar targeting was observed in the Ecuadorian military, demonstrating the group’s regional expansion in Latin America. No public attribution to a state sponsor or criminal consortium has been made for Machete based on the available sources.