aol.pm

Machete

IntrusionSet · ATTACK:enterprise:G0095

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0095",
  "title": "Machete",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0095",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--38863958-a201-4ce1-9dbe-539b0b6804e0",
  "external_id": "G0095",
  "domain": "enterprise",
  "created": "2019-09-13T12:37:10.394Z",
  "modified": "2026-07-31T18:47:49.445Z",
  "version": "2.0",
  "aliases": [
    "Machete",
    "APT-C-43",
    "El Machete"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Machete"
    },
    {
      "source_name": "APT-C-43"
    },
    {
      "source_name": "El Machete"
    },
    {
      "source_name": "Cylance Machete Mar 2017",
      "url": "https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"
    },
    {
      "source_name": "Securelist Machete Aug 2014",
      "url": "https://securelist.com/el-machete/66108/"
    },
    {
      "source_name": "ESET Machete July 2019",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"
    },
    {
      "source_name": "360 Machete Sep 2020",
      "url": "https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"
    }
  ]
}

Explicit source assertions (12)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f880e99-efaa-4e85-91c3-cac3d81d6b9a

Cylance Machete Mar 2017 · Securelist Machete Aug 2014 · ESET Machete July 2019 · 360 Machete Sep 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dde02b3-20b9-4709-96b4-02dbb9150577

Cylance Machete Mar 2017 · ESET Machete July 2019

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a01d374-1a49-4443-b7b5-453ebe5671ea

360 Machete Sep 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--472878d3-3a6a-4ad2-8fcf-e73a74fd48b6

360 Machete Sep 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--532feb00-b2ba-4cf6-81e8-57750d30b039

Cylance Machete Mar 2017 · ESET Machete July 2019 · 360 Machete Sep 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--818dc2b8-bc95-4e1e-a25a-8c659b9a141d

360 Machete Sep 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b19ae2dc-9cbe-45b8-8b9c-ce0cd9add29a

360 Machete Sep 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba84c2c2-e5bf-432e-9827-6d622490ba2d

Cylance Machete Mar 2017 · Securelist Machete Aug 2014 · ESET Machete July 2019

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb2be1f4-f2fc-4029-8ee6-e89f52210dfd

Securelist Machete Aug 2014

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd3926e9-9c91-43f2-913d-16a7e94cc0ae

Securelist Machete Aug 2014 · ESET Machete July 2019 · 360 Machete Sep 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1218.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3e2ba96-28bb-48be-b46b-3c2349f4d0cd

360 Machete Sep 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:S0409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f33b1a88-1c1c-4ea4-a1b3-f1198012e728

Securelist Machete Aug 2014 · ESET Machete July 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.