2 malware familiesExploits CVEs in the wild

Malteiro

Also known asMalteiro

Malteiro is a criminal group believed to be based in Brazil. It is known for operating and distributing the Mispadu/URSA banking trojan through a malware-as-a-service model. Reported activity includes spearphishing emails containing malicious .zip attachments and reliance on user execution of .zip file attachments containing malicious URLs. Malteiro has used scripts encoded in Base64 certificates to distribute malware and can deobfuscate downloaded files prior to execution. The group collects victim machine information including system architecture, OS version, computer name, Windows product name, and other machine details. It also performs language-based targeting, terminating Mispadu infection if the victim machine language is not Spanish or Portuguese. Credential theft activity includes stealing browser-stored credentials via NirSoft WebBrowserPassView and obtaining credentials from mail clients via NirSoft MailPassView. The only alias directly supported in the content is malteiro.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

29 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

9 of 15 tactics39 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0043

Reconnaissance

1 technique

T1590

Gather Victim Network Information

T1590.005

IP Addresses

TA0001

Initial Access

1 technique

T1566

Phishing

T1566.001×27

Spearphishing Attachment

T1566.002×4

Spearphishing Link

TA0002

Execution

2 techniques

T1059

Command and Scripting Interpreter

T1059.001×2

PowerShell

T1059.005×8

Visual Basic

T1204

User Execution

T1204.001

Malicious Link

T1204.002×12

Malicious File

TA0003

Persistence

1 technique

T1137

Office Application Startup

TA0004

Privilege Escalation

1 technique

T1055

Process Injection

T1055.001×4

Dynamic-link Library Injection

TA0005

Stealth

6 techniques

T1027×2

Obfuscated Files or Information

T1027.013×2

Encrypted/Encoded File

T1036

Masquerading

T1036.008

Masquerade File Type

T1055

Process Injection

T1055.001×4

Dynamic-link Library Injection

T1140

Deobfuscate/Decode Files or Information

T1218

System Binary Proxy Execution

T1218.005

Mshta

T1564

Hide Artifacts

T1564.006

Run Virtual Instance

TA0006

Credential Access

2 techniques

T1003

OS Credential Dumping

T1555×4

Credentials from Password Stores

T1555.003×5

Credentials from Web Browsers

T1555.005

Password Managers

TA0007

Discovery

6 techniques

T1018

Remote System Discovery

T1046

Network Service Discovery

T1082×11

System Information Discovery

T1087

Account Discovery

T1087.002

Domain Account

T1518

Software Discovery

T1518.001

Security Software Discovery

T1614

System Location Discovery

T1614.001×2

System Language Discovery

TA0040

Impact

1 technique

T1657

Financial Theft

ARSENAL

Associated malware families

2 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

MispaduMispadu checks and will terminate execution if the compromised system’s language ID is not Spanish or Portuguese.4May 26, 2026

WebBrowserPassViewKimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.2Mar 18, 2026

WEAPONIZED

Associated vulnerabilities

1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityIn the wildEvidence2

This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

splunk researchNews

Apr 22, 2026

Detection: PowerShell PInvoke Process Injection API Chain | Splunk Security Content

Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.

splunk researchNews

Apr 13, 2026

Detection: Windows Binary Execution from an Archive | Splunk Security Content

Listed as a threat actor associated with the malicious file execution technique detected by this analytic.

splunk researchNews

Apr 13, 2026

Detection: Windows EFI Volume Mount Attempt Via Mountvol | Splunk Security Content

Listed in the detection annotations as a threat actor associated with EFI volume mounting / installation-related behavior.

splunk researchNews

Apr 13, 2026

Detection: Windows WinPEAS PowerShell Script Execution | Splunk Security Content

Listed as a threat actor associated with WinPEAS-related post-exploitation/reconnaissance activity in the detection metadata.

+73 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping29

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal2

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs1

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.