Loading story…
The Machete cyberespionage group continued targeting government and military organizations in Latin America, with recent activity focused on Venezuelan government entities and the Ecuadorean military. Researchers observed more than 50 compromised systems communicating with Machete command-and-control infrastructure over a two-month period, while operators exfiltrated gigabytes of confidential data each week. The campaign relied on highly tailored spearphishing emails that used stolen legitimate documents as decoys and reflected detailed knowledge of military communications and target-specific terminology.
The malware toolset, active for years under the names Machete and El Machete, evolved into a more capable Python-based platform with added obfuscation, persistence, geolocation, browser data theft, removable-media collection, and data exfiltration over FTP with HTTP fallback. Reporting across multiple investigations indicates the group has maintained a long-running focus on Latin American targets, and researchers assessed the operators are likely Spanish-speaking and may have a physical presence in one of the affected countries, partly because the malware supports copying stolen data to removable drives.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
ESET disclosed an ongoing cyberespionage campaign by the Machete group that stole gigabytes of confidential data, primarily from Venezuelan government organizations and the Ecuadorean military.
Since May 2019, the operators stopped using separate downloaders and began delivering the decoy document and backdoor components together in the same self-extracting archive.
From late March to late May 2019, ESET observed more than 50 victimized computers actively communicating with Machete command-and-control infrastructure, with most compromised hosts belonging to Venezuelan government organizations.
Since August 2018, Machete components included an additional obfuscation layer using zlib-compressed, base64-encoded text produced with pyminifier, showing further malware hardening.
ESET reported that a new version of the Python-based Machete malware toolset was first seen in April 2018, indicating a significant evolution of the group's capabilities.
Cylance released research describing El Machete malware attacks targeting Latin America, providing another public analysis of the campaign.
Securelist published research on the El Machete malware campaign, marking an early public documentation of the threat actor and its activity in Latin America.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourcethreatvector.cylance.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CloudSEK disclosed a coordinated intrusion campaign dubbed **Operation Escaneo** that targeted government, financial, and critical infrastructure organizations across Latin America, with Mexico as the primary focus and additional victim activity in Ecuador and Portugal. Researchers traced the operation after attackers accidentally exposed a staging server, revealing a mature toolchain that exploited internet-facing **Fortinet FortiOS SSL-VPN**, **Ivanti Connect Secure**, and **Apache Tomcat** systems, while also maintaining capabilities for `EternalBlue`, `Zerologon`, `GhostCat`, `Log4Shell`, and `PwnKit`. CloudSEK attributed the activity with medium confidence to **MexicanMafia**, also tracked as **PanchoVilla**, and said confirmed victim beacons and callbacks showed successful compromise of multiple organizations. The attackers used a custom reconnaissance framework called **Kimera**, **Neo-reGeorg** web shells, **Chisel** reverse tunnels, and persistence on compromised Cisco routers through **GRE tunnels** to retain access and evade detection. Investigators said the campaign moved across Windows, Linux, SAP ERP, Oracle, PostgreSQL, and network infrastructure, using tools such as **RDP**, **PsExec**, and **Impacket** for lateral movement and privilege escalation. Reported theft included a **407 MB BloodHound** Active Directory dataset, more than **1.3 million personal records**, and **SSL private keys**, including material tied to tax authority infrastructure, indicating both financially motivated theft and possible intelligence collection.
Jun 29, 2026
State-sponsored threat groups used Russia-Ukraine war-themed phishing documents to conduct cyber-espionage campaigns across Latin America, the Middle East, and South Asia. Check Point Research reported that **El Machete** targeted financial and government organizations in Nicaragua and Venezuela with malicious Word files that delivered Python-based malware, including a customized **Loki.Rat** variant and a second-stage **JavaOracle** payload, while **Lyceum** targeted the energy sector in Israel and likely Saudi Arabia using war-related decoys and droppers to install **.NET DNS**, **.NET TCP**, and **Golang HTTP** backdoors. In South Asia, **SideWinder** targeted Pakistani entities with a Russia-Ukraine-themed lure that used remote template injection and exploited **`CVE-2017-11882`** to deploy its long-running **.NET infostealer**. The activity showed how espionage-focused actors quickly adapted a major geopolitical crisis into convincing spear-phishing content to improve targeting and compromise government, financial, and energy-sector victims.
Aug 15, 2026
A long-running cyberespionage operation dubbed **Bandidos** used the **Bandook** remote access trojan to infiltrate corporate networks across Spanish-speaking Latin America, with roughly 90% of observed detections concentrated in Venezuela. The campaign, active since at least 2015, relied on phishing emails carrying PDF lures that directed victims to password-protected archives containing a Delphi dropper. That dropper injected Bandook into `iexplore.exe` through process hollowing, established persistence via Windows Registry changes, and connected to command-and-control servers over TCP. Researchers said the malware supported extensive surveillance and theft functions, including screenshot capture, webcam and microphone recording, USB data theft, and interception of Chrome credentials, while also downloading additional DLLs to expand capability. The 2021 variant showed notable evolution from earlier Bandook activity, including a shift from `CAST-256` to `GOST` in the dropper, a reduced DLL set, and support for 132 commands. The infrastructure and tooling overlapped with previously documented Bandook-linked operations, including **Operation Manul**, **Dark Caracal**, and Check Point research, reinforcing the assessment that the operators were conducting sustained espionage against Venezuelan organizations in sectors such as manufacturing, construction, healthcare, software services, and retail.
Aug 14, 2026