- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Brazil(medium confidence)
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G1026 · 12 techniques
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0420 · malteiro
BrazilWhat it is
Malteiro is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the Mispadu banking trojan via a Malware-as-a-Service (MaaS) business model. Malteiro mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ThreatActor.info (Malpedia et al.)Brazil · high
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- Mispadu
- Trojan.Karagany
- Trojan.Mebromi
Sources
- MITRE ATT&CK attack.mitre.org
- Malpedia malpedia.caad.fkie.fraunhofer.de