group

Metador G1013

Created: 25 January 2023
Last modified: 31 July 2026
Alias: Metador

Metador is a suspected cyber espionage group that was first reported in September 2022. Metador has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group Metador based on the "I am meta" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.[1]

Techniques30th pct

Tactics34th pct

Tools & malware39th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

MITRE reference G1013

Encrypted/Encoded File T1027.013↗

Metador has encrypted their payloads.2

Stealth1 detection rules

Windows Command Shell T1059.003↗

Metador has used the Windows command line to execute commands.3

Execution61 detection rules

File Deletion T1070.004↗

Metador has quickly deleted cbd.exe from a compromised host following the successful deployment of their malware.4

Stealth30 detection rules

Web Protocols T1071.001↗

Metador has used HTTP for C2.5

Command and Control57 detection rules

Non-Application Layer Protocol T1095↗

Metador has used TCP for C2.6

Command and Control5 detection rules

Ingress Tool Transfer T1105↗

Metador has downloaded tools and malware onto a compromised system.7

Command and Control129 detection rules

Standing G1013

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques930th pct

30th percentile · 70% of 176 ATT&CK groups have more Enterprise techniques.

Tactics634th pct

34th percentile · 66% of 176 ATT&CK groups have more tactics spanned.

Tools & malware239th pct

39th percentile · 61% of 176 ATT&CK groups have more tools and malware.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique15med43rd pct

43rd percentile · 57% of 176 ATT&CK groups have more detection rules per technique.

Tests / technique3med

Detection coverage G1013

305 distinct rules cover the 9 techniques recorded for this group. The 312 technique-to-rule mappings resolve to 305 distinct rules, because one rule can cover several techniques. 212 Sigma · 93 Splunk.

9 covered by at least one rule305 distinct rules in total

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs

© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org

MITRE reference G1013

Reach

Coverage

How it got here