THREAT_ACTOR · G1026
Malteiro
Also known as: Malteiro
Profile
Malteiro is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the Mispadu banking trojan via a Malware-as-a-Service (MaaS) business model. Malteiro mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).
MITRE ATT&CK ↗Techniques
12 ATT&CK techniques attributed to this actor.
T1027.013 Encrypted/Encoded FileT1055.001 Dynamic-link Library InjectionT1059.005 Visual BasicT1082 System Information DiscoveryT1140 Deobfuscate/Decode Files or InformationT1204.002 Malicious FileT1518.001 Security Software DiscoveryT1555 Credentials from Password StoresT1555.003 Credentials from Web BrowsersT1566.001 Spearphishing AttachmentT1614.001 System Language DiscoveryT1657 Financial Theft
Software
1 malware/tools attributed to this actor.
Mispadu
Related corpus activity
9,504 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Malteiro.
| Indicator | Type | Family | Sev | Src |
|---|---|---|---|---|
| cve-2020-22658 | cve | — | 85 | 2 |
| cve-2025-34085 | cve | — | 85 | 1 |
| cve-2024-1781 | cve | — | 85 | 1 |
| cve-2020-22653 | cve | — | 85 | 2 |
| cve-2021-25646 | cve | — | 85 | 1 |
| cve-2025-12057 | cve | — | 85 | 1 |
| cve-2025-11837 | cve | — | 85 | 2 |
| cve-2025-34054 | cve | — | 85 | 4 |
| cve-2026-3102 | cve | — | 85 | 3 |
| cve-2020-17456 | cve | — | 85 | 1 |
| cve-2026-4368 | cve | ransomware | 85 | 1 |
| cve-2013-7471 | cve | — | 85 | 1 |
| cve-2026-0740 | cve | — | 85 | 1 |
| cve-2026-3844 | cve | — | 85 | 1 |
| cve-2021-27076 | cve | — | 85 | 1 |
| cve-2013-3307 | cve | — | 85 | 2 |
| cve-2025-68670 | cve | — | 85 | 2 |
| cve-2016-15047 | cve | — | 85 | 4 |
| cve-2018-8007 | cve | — | 85 | 1 |
| cve-2014-2321 | cve | — | 85 | 1 |
| cve-2023-44976 | cve | ransomware | 85 | 2 |
| cve-2021-4045 | cve | — | 85 | 1 |
| cve-2025-2492 | cve | — | 85 | 2 |
| cve-2025-34117 | cve | — | 85 | 1 |
| cve-2017-18377 | cve | — | 85 | 1 |
| cve-2016-5681 | cve | — | 85 | 2 |
| cve-2021-29441 | cve | — | 85 | 1 |
| cve-2026-1969 | cve | — | 85 | 1 |
| cve-2022-47945 | cve | — | 85 | 1 |
| cve-2025-7443 | cve | — | 85 | 1 |
Showing the top 30 by severity of 9,504.