{
	"id": "b53afb54-a86a-4ea7-be94-d72f06f2f669",
	"created_at": "2026-04-06T00:11:09.855397Z",
	"updated_at": "2026-04-10T03:37:19.415504Z",
	"deleted_at": null,
	"sha1_hash": "2eeb052a53b7c9ac4122cc9c87d795fd88c487d9",
	"title": "Report | The Mystery of Metador | An Unattributed Threat Hiding in Telcos, ISPs, and Universities",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 30808,
	"plain_text": "Report | The Mystery of Metador | An Unattributed Threat Hiding\r\nin Telcos, ISPs, and Universities\r\nBy Author:\r\nArchived: 2026-04-05 13:44:01 UTC\r\n1THE MYSTERY OF M E TA D O R | A N U N AT T R I B U T E D T H R E AT H I D I N G I N T E LCOS , I S\r\nP S , A N D U N I V E R S I T I E S\r\nTHE MYSTERY OF METADOR |\r\nAN UNATTRIBUTED THREAT\r\nHIDING IN TELCOS, ISPS,\r\nAND UNIVERSITIES\r\nAuthor: Amitai Ben Shushan Ehrlich,\r\nAleksandar Milenkoski, Juan Andres Guerrero-Saade\r\nSeptember 2022\r\nSentinelLABS Research Team\r\n2THE MYSTERY OF M E TA D O R | A N U N AT T R I B U T E D T H R E AT H I D I N G I N T E LCOS , I S\r\nP S , A N D U N I V E R S I T I E S\r\nTABLE OF\r\nCONTENTS\r\n3 EXECUTIVE SUMMMARY\r\n4 OVERVIEW\r\n6 TECHNICAL OVERVIEW\r\n7 THE MANY SUPPORTED\r\nEXECUTION FLOWS\r\nOF METAMAIN\r\n11 MAFALDA\r\n17 ADDITIONAL IMPLANTS\r\n20 INFRASTRUCTURE\r\n22 ATTRIBUTION AND TIMELINE\r\n25 CONCLUSION\r\n26 APPENDIX:\r\nINDICATORS OF COMPROMISE\r\n27 ABOUT SENTINELLABS\r\nSource: https://assets.sentinelone.com/sentinellabs22/metador#page=1\r\nhttps://assets.sentinelone.com/sentinellabs22/metador#page=1\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://assets.sentinelone.com/sentinellabs22/metador#page=1"
	],
	"report_names": [
		"metador#page=1"
	],
	"threat_actors": [
		{
			"id": "ba626326-d049-472c-ba57-b64943d96dc2",
			"created_at": "2023-11-05T02:00:08.075744Z",
			"updated_at": "2026-04-10T02:00:03.398399Z",
			"deleted_at": null,
			"main_name": "Metador",
			"aliases": [],
			"source_name": "MISPGALAXY:Metador",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "afa52232-4252-4c67-ac65-6e60eb113fde",
			"created_at": "2023-04-26T02:03:03.138144Z",
			"updated_at": "2026-04-10T02:00:05.366656Z",
			"deleted_at": null,
			"main_name": "Metador",
			"aliases": [
				"Metador"
			],
			"source_name": "MITRE:Metador",
			"tools": [
				"metaMain",
				"Mafalda"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775434269,
	"ts_updated_at": 1775792239,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2eeb052a53b7c9ac4122cc9c87d795fd88c487d9.pdf",
		"text": "https://archive.orkl.eu/2eeb052a53b7c9ac4122cc9c87d795fd88c487d9.txt",
		"img": "https://archive.orkl.eu/2eeb052a53b7c9ac4122cc9c87d795fd88c487d9.jpg"
	}
}