- Category
- State · Attributed to a state or working for one.
- Origin
- Unknown
- Sponsor
- Unknown
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2010–2026
- Status
- Active
- ATT&CK
- G0095 · 11 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0133 · machete
What it is
Machete is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010. It has primarily focused its operations within Latin America, with a particular emphasis on Venezuela, but also in the US, Europe, Russia, and parts of Asia. Machete generally targets high-profile organizations such as government institutions, intelligence services, and military units, as well as telecommunications and power companies.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Mandiant
- TEMP.Andromeda
- MITRE ATT&CK
- G0095
- Qihoo 360
- APT-C-43
- Operations
- Operation “HpReact”
- Other names
- El Machete, ATK 97, Machete - APT-C-43, machete-apt, TAG-NS1
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- MISP Galaxy (CFR tagging)no origin
Targets
- Countries
- Argentina, Belgium, Bolivia, Brazil, Canada, China, Colombia, Cuba, Dominican Republic, Ecuador, France, Germany, Guatemala, Malaysia, Mexico, Nicaragua, Peru, Russia, South Korea, Spain, Sweden, Ukraine, United Kingdom, United States, Venezuela
- Sectors
- Defense, Education, Embassies, Energy, Government, Military, Telecommunications
Tools
The tools and malware families the sources tie to it.
- Machete
- Minimo
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net