Threat Actor Profile
Description
Malteiro is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the Mispadu banking trojan via a Malware-as-a-Service (MaaS) business model. Malteiro mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).(Citation: SCILabs Malteiro 2021)
Confidence Score
Known Aliases
Tags
First Seen
Unknown
Last Updated
Unknown
Active Status
ActiveCreated
April 29, 2026
MITRE ATT&CK Techniques (12)
Indicators of Compromise
Loading IOCs…
IOC KQL for Sentinel
STIX Data
{'aliases': ['Malteiro'],
'created': '2024-03-13T20:23:54.698Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': '[Malteiro](https://attack.mitre.org/groups/G1026) is a '
'financially motivated criminal group that is likely based in '
'Brazil and has been active since at least November 2019. The '
'group operates and distributes the '
'[Mispadu](https://attack.mitre.org/software/S1122) banking '
'trojan via a Malware-as-a-Service (MaaS) business model. '
'[Malteiro](https://attack.mitre.org/groups/G1026) mainly '
'targets victims throughout Latin America (particularly '
'Mexico) and Europe (particularly Spain and '
'Portugal).(Citation: SCILabs Malteiro 2021)',
'external_references': [{'external_id': 'G1026',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/groups/G1026'},
{'description': 'SCILabs. (2021, December 23). Cyber '
'Threat Profile Malteiro. Retrieved '
'March 13, 2024.',
'source_name': 'SCILabs Malteiro 2021',
'url': 'https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/'}],
'id': 'intrusion-set--bf668120-e9a6-4017-a014-bfc0f5232656',
'modified': '2024-03-29T14:10:35.711Z',
'name': 'Malteiro',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'intrusion-set',
'x_mitre_attack_spec_version': '3.2.0',
'x_mitre_contributors': ['Daniel Fernando Soriano Espinosa', 'SCILabs'],
'x_mitre_deprecated': False,
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_version': '1.0'}