Forensia CTI Core

Profile

Machete is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010. It has primarily focused its operations within Latin America, with a particular emphasis on Venezuela, but also in the US, Europe, Russia, and parts of Asia. Machete generally targets high-profile organizations such as government institutions, intelligence services, and military units, as well as telecommunications and power companies.

MITRE ATT&CK ↗

Techniques

11 ATT&CK techniques attributed to this actor.

T1036.005 Match Legitimate Resource Name or Location T1053.005 Scheduled Task T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.006 Python T1189 Drive-by Compromise T1204.001 Malicious Link T1204.002 Malicious File T1218.007 Msiexec T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Software

1 malware/tools attributed to this actor.

Machete

Related corpus activity

9,144 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Machete.

Indicator	Type	Family	Sev	Src
cve-2025-68670	cve	—	85	2
cve-2021-27137	cve	—	85	8
cve-2026-4368	cve	ransomware	85	1
cve-2025-34054	cve	—	85	4
cve-2021-27076	cve	—	85	1
cve-2026-3102	cve	—	85	3
cve-2016-15047	cve	—	85	4
cve-2023-44976	cve	ransomware	85	2
60972abf5425c191c81bae117f1dedaea13d39bc52f367d5dff9ad1aa4b9c5ca	sha256	phishing	80	2
5272917261d7091a59e00f9d09cd7eb1d3e111115a5b367f79a66d0d7c7b01f4	sha256	phishing	80	2
221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9	sha256	—	80	1
9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470	sha256	—	80	1
5ab41cf20315d2ea1385967d588159873a65ef5581a0b78de06c0d8617894194	sha256	phishing	80	2
9c44bc9373377831c45dd0ac2661a28e	hash	—	80	3
62a879b0d1c1649cc72b2b6f61a8f6bd888625ce6e8a7aefe0a0461e4f27c525	sha256	phishing	80	2
873f1277a42de5c82f869459e7fb7c94554a642b	hash	—	80	3
22de84e8f29cba932cf65cf4dc1d333cb8b2e468204f97030712bee32691ac3b	sha256	phishing	80	2
2654c08491a0f7c4a3dfc6282de5638b	hash	—	80	3
669002654c264191d4660fbf757860d930175649735f81370b9f1af3658a304c	sha256	phishing	80	2
43d597783af656a35184021f5e20686896463a1712f9216e0217a2ca740e3935	sha256	phishing	80	2
23b37d2ebe683cec3b145b6f2234ee728b99228cf3774399fcfad9502daab9a9	sha256	phishing	80	2
625b6535321d58bb5c613e85332bf731	hash	—	80	3
681075027553546c119ec447eb8df84633dcffce	hash	—	80	3
a7bd8869293212e1671df90d2d41b96d4933eb9408b1111bd830e111a91bb202	hash	phishing	80	2
248ded4723e9f5da793e5e42d1ba7c2293dd704718f149b84b3b9b818a1f51db	sha256	phishing	80	2
03b51af0a04467cebfa235199db4c02e	hash	wallet_compromise	80	1
123e80a34508c4dede7cc70e76931fcc	hash	—	80	3
b8eed63ab9cbdca494f26a6f66bfd4a0a693b3f0	hash	—	80	3
bd46890121106b43f0c01ab82629400c	hash	cryptojacking	80	2
61e9d76f07334843df561fe4bac449fb6fdaed5e5eb91480bded225f3d265c5f	hash	phishing	80	2

Showing the top 30 by severity of 9,144.