Malware

MataDoor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

The updated MATA malware was distributed via spear-phishing techniques to target victims... From several victims, we observed the actor sending spear-phishing documents.

Execution

2 techniques

T1059.001PowerShellEvidence1

The ability to run arbitrary PowerShell scripts through this compliance solution allowed the attacker... to execute a command to download and run the MataDoor malware.

T1059.003Windows Command ShellEvidence1

Send execution results to the C2 server... run the given command with “cmd.exe /C”.

Persistence

1 technique

T1112Modify RegistryEvidence1

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" ... reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service_name>\Parameters"

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

Inject LoadLibrary call into process specified by ID... Inject reflective loader into process specified by name that loads DLL from file

Stealth

3 techniques

T1036MasqueradingEvidence1

All the MataDoor samples we discovered were Windows executables and disguised as legitimate programs such as a security solution agent, VPN client, Adobe programs and such.

T1055Process InjectionEvidence1

Inject LoadLibrary call into process specified by ID... Inject reflective loader into process specified by name that loads DLL from file

T1070.004File DeletionEvidence1

Immediately after installing the malware, the attackers removed the loader module: del c:\users\public\libraries\library-ms.exe

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" ... reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service_name>\Parameters"

Discovery

6 techniques

T1016System Network Configuration DiscoveryEvidence1

The actor... examined the network status... cmd.exe /c "netstat -ano | find "TCP"" ... ipconfig /all

T1046Network Service DiscoveryEvidence1

Probe TCP connection to specified IP-address:port... Probe TCP connections to IP-subnet:port... ICMP ping all hosts in subnet

T1057Process DiscoveryEvidence1

Returns following details about all currently running processes... PID, parent PID, command line...

T1082System Information DiscoveryEvidence1

Returns victim ID, configuration settings... and various system information such as Windows version, Processor architecture, Computer name, User name

T1083File and Directory DiscoveryEvidence1

Returns the list of files in specified folder or list of logical drive types

T1135Network Share DiscoveryEvidence1

Scan given subnet for available Windows shares, try to connect them with specified credentials

Lateral Movement

2 techniques

T1021.002SMB/Windows Admin SharesEvidence1

Connect to remote Windows shared resource (disk or printer) with specified credentials

T1570Lateral Tool TransferEvidence1

The malware was then copied onto the host.

Collection

1 technique

T1560Archive Collected DataEvidence1

Pack files to zip archive and upload it to C2 server

Command and Control

5 techniques

T1071Application Layer ProtocolEvidence1

The new MATA generations incorporate new functionalities... creating a 'stack' of various communication protocols to be used for C2 (Command and Control) communications.

T1090ProxyEvidence1

The malware TCP connects to two remote hosts... and then forwards traffic between them... Implements HTTP proxy server... Implements SOCKS4 proxy server

T1090.003Multi-hop ProxyEvidence1

allowing the actor to build complex proxy chains within the victims’ network... Add this victim to a proxy chain.

T1105Ingress Tool TransferEvidence1

This malware has trivial functionality, fetching a payload from a remote server and executing it... Several victims were also infected with the Loader malware... fetching the next stage payload from the embedded URL

T1573Encrypted ChannelEvidence1

Periodically the malware connects to the C2 server using libcurl, performs a handshake, sets up AES session keys and IVs... This malware leverages the open source library 'OpenSSL 1.1.1k' for covert network communication.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Upload file to C2 server... Send execution results to the C2 server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

ics cert kasperskyNews

Oct 18, 2023

Updated MATA attacks industrial companies in Eastern Europe | Kaspersky ICS CERT

A rewritten-from-scratch Windows backdoor variant within the MATA family (gen4), typically disguised as legitimate software and often packed with Themida. It runs as a service (e.g., 'wuausrv'), uses encrypted configuration, supports active and passive C2 modes over multiple transports (SSL/DTLS/TCP/UDP), and enables internal proxying/proxy chains and modular plugin-driven capabilities (processes, files, net recon, proxy, inject, monitoring).

kaspersky content hub mediaNews

Aug 14, 2026

A rewritten-from-scratch MATA variant for Windows with modular plugins, passive/active C2 modes, SSL/DTLS/TCP/UDP communications, proxy chaining, process/file/network operations, injection, and monitoring capabilities.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

MataDoor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

The updated MATA malware was distributed via spear-phishing techniques to target victims... From several victims, we observed the actor sending spear-phishing documents.

Execution

2 techniques

T1059.001PowerShellEvidence1

The ability to run arbitrary PowerShell scripts through this compliance solution allowed the attacker... to execute a command to download and run the MataDoor malware.

T1059.003Windows Command ShellEvidence1

Send execution results to the C2 server... run the given command with “cmd.exe /C”.

Persistence

1 technique

T1112Modify RegistryEvidence1

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" ... reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service_name>\Parameters"

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

Inject LoadLibrary call into process specified by ID... Inject reflective loader into process specified by name that loads DLL from file

Stealth

3 techniques

T1036MasqueradingEvidence1

All the MataDoor samples we discovered were Windows executables and disguised as legitimate programs such as a security solution agent, VPN client, Adobe programs and such.

T1055Process InjectionEvidence1

Inject LoadLibrary call into process specified by ID... Inject reflective loader into process specified by name that loads DLL from file

T1070.004File DeletionEvidence1

Immediately after installing the malware, the attackers removed the loader module: del c:\users\public\libraries\library-ms.exe

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" ... reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service_name>\Parameters"

Discovery

6 techniques

T1016System Network Configuration DiscoveryEvidence1

The actor... examined the network status... cmd.exe /c "netstat -ano | find "TCP"" ... ipconfig /all

T1046Network Service DiscoveryEvidence1

Probe TCP connection to specified IP-address:port... Probe TCP connections to IP-subnet:port... ICMP ping all hosts in subnet

T1057Process DiscoveryEvidence1

Returns following details about all currently running processes... PID, parent PID, command line...

T1082System Information DiscoveryEvidence1

Returns victim ID, configuration settings... and various system information such as Windows version, Processor architecture, Computer name, User name

T1083File and Directory DiscoveryEvidence1

Returns the list of files in specified folder or list of logical drive types

T1135Network Share DiscoveryEvidence1

Scan given subnet for available Windows shares, try to connect them with specified credentials

Lateral Movement

2 techniques

T1021.002SMB/Windows Admin SharesEvidence1

Connect to remote Windows shared resource (disk or printer) with specified credentials

T1570Lateral Tool TransferEvidence1

The malware was then copied onto the host.

Collection

1 technique

T1560Archive Collected DataEvidence1

Pack files to zip archive and upload it to C2 server

Command and Control

5 techniques

T1071Application Layer ProtocolEvidence1

The new MATA generations incorporate new functionalities... creating a 'stack' of various communication protocols to be used for C2 (Command and Control) communications.

T1090ProxyEvidence1

The malware TCP connects to two remote hosts... and then forwards traffic between them... Implements HTTP proxy server... Implements SOCKS4 proxy server

T1090.003Multi-hop ProxyEvidence1

allowing the actor to build complex proxy chains within the victims’ network... Add this victim to a proxy chain.

T1105Ingress Tool TransferEvidence1

T1573Encrypted ChannelEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Upload file to C2 server... Send execution results to the C2 server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

ics cert kasperskyNews

Oct 18, 2023

Updated MATA attacks industrial companies in Eastern Europe | Kaspersky ICS CERT

kaspersky content hub mediaNews

Aug 14, 2026

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.