Malteiro
Overview
Malteiro is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the Mispadu banking trojan via a Malware-as-a-Service (MaaS) business model. Malteiro mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).
Naming & attribution
It uses 12 documented ATT&CK techniques — more than 35% of the 174 groups tracked here.
Closest groups by technique overlap
Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.
- Molerats — 5 shared techniques (22% overlap)
- SideCopy Pakistan — 5 shared techniques (22% overlap)
- Inception Russia — 6 shared techniques (21% overlap)
- TA459 China — 3 shared techniques (21% overlap)
- Darkhotel South Korea — 6 shared techniques (20% overlap)
- Ajax Security Team Iran — 3 shared techniques (20% overlap)
Malware families with tracked indicators
One family attributed to Malteiro, with 6 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.
- Mispadu6 indicators
Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.
TTPs — 12 techniques across 6 tactics
Initial Access
T1566.001Spearphishing Attachment
Execution
T1059.005Visual BasicT1204.002Malicious File
Stealth
T1027.013Encrypted/Encoded FileT1055.001Dynamic-link Library InjectionT1140Deobfuscate/Decode Files or Information
Credential Access
Discovery
T1082System Information DiscoveryT1518.001Security Software DiscoveryT1614.001System Language Discovery
Impact
T1657Financial Theft
Tools & malware (1)
Mispadu
Reporting (1)
- Cyber Threat Profile Malteiro — SCILabs