How We Hunted a Latin American Spy Group Using MISP A Threat Intelligence Investigation

A step-by-step breakdown of how our team deployed MISP, extracted real-world IOCs, and built a full threat actor profile on El Machete (APT-C-43)

Imagine receiving intelligence that a sophisticated cyber espionage group has been quietly operating inside government networks, military systems, and critical infrastructure stealing documents, recording keystrokes, and exfiltrating data for years without anyone noticing.

That is not a hypothetical. That is El Machete.

Who Is El Machete? we needed to answer the bigger question who are these people, what do they want, and how do they operate?

Identity and Background

El Machete is also tracked as APT-C-43 and appears in the MITRE ATT&CK framework as group G0095. The group is Spanish-speaking and assessed to be based in Latin America, most likely South or Central America. Attribution remains analytically assessed rather than formally confirmed meaning no government has publicly named a specific country or individual behind the group.

What makes El Machete particularly interesting is their longevity. They have been active since at least 2010 and have continued operating even after multiple public exposures by major security research firms including Kaspersky, ESET, and CIRCL. Most threat actors go quiet after being publicly named. El Machete adapted and kept going.

What Do They Want?

El Machete is not after money. They are not running ransomware or stealing credit cards. They are a cyber espionage group their goal is long-term intelligence collection.

The data they steal tells the story clearly. Documented stolen material includes government correspondence, military documents, navigation routes, geolocation data, browser credentials, and surveillance recordings. This is the kind of data that intelligence agencies collect not criminals.

Who Do They Target?

El Machete focuses almost exclusively on high-value strategic targets:

Government institutions and ministries Military units and commands Intelligence services and embassies Law enforcement bodies Telecommunications providers Energy organizations

Their primary geographic focus is Latin America particularly Venezuela, Ecuador, Colombia, Peru, Cuba, Argentina, Bolivia, and Nicaragua. However additional victims have been reported in the United States, Russia, Spain, Germany, the United Kingdom, and parts of Asia.

Notable Campaigns

The 2014 Machete Campaign Large-scale attacks against Latin American military and government targets. This was the campaign that first brought the group to public attention when Kaspersky published their initial research.

Sharpening the Machete (2019) — A major operation involving mass exfiltration from Venezuelan institutions. ESET and CIRCL both published research on this campaign. The MISP events we analyzed events 1552 and 210 are directly linked to this campaign.

Russia-Ukraine War Lures (2022 onwards) — El Machete adapted their social engineering to use geopolitically themed documents related to the Russia-Ukraine conflict as decoys. This shows a group that watches world events and tailors their attacks accordingly.

Their Malware The Machete Toolkit

El Machete’s core malware is a custom Python-based espionage toolkit known as Machete, with later variants also called Pyark or Fpyark. It is modular meaning different capabilities can be added or removed depending on the target and objective.

Documented capabilities include:

Keylogging — recording every key the victim presses Screen capture — taking regular screenshots of the victim’s desktop Audio and video recording — activating the microphone and webcam Browser credential theft — stealing saved passwords from browsers Clipboard monitoring — capturing everything copied to the clipboard File enumeration and exfiltration — finding and stealing specific files Geolocation tracking — determining the physical location of the victim

The malware is typically packaged into Windows executables using PyInstaller — a tool that converts Python scripts into standalone .exe files. This is why we see filenames like python27.exe and Chrome.exe in the IOC data the malware is hiding inside what looks like a legitimate Python or Chrome process.

El Machete also abuses legitimate Windows tools to avoid detection:

msiexec.exe — Windows installer wscript.exe — Windows script host certutil.exe — certificate utility Scheduled Tasks — for persistence across reboots

Using legitimate system tools for malicious purposes is a technique known as Living off the Land and it is one of the hardest attacker behaviours to detect because the tools being used are supposed to be there.

As part of a national CERT simulation exercise, our team was assigned to investigate one of five suspected threat actor groups believed to be behind a wave of attacks targeting critical infrastructure and government agencies in Europe. We got Group 2 El Machete.

This article documents exactly what we did and what we found

Tools and Technologies Used

MISP (Malware Information Sharing Platform) Docker and Docker Compose Git FireHOL Blocklist ATT&CK Framework

What Is MISP and Why Does It Matter?

Before we get into the investigation, let me explain the tool at the center of this project MISP (Malware Information Sharing Platform).

Think of MISP as a collaborative intelligence database. Security teams, CERTs, and researchers from around the world contribute real-world threat

data IP addresses, domains, malware hashes, attack patterns and MISP organizes all of it into structured, searchable events.

Instead of every security team hunting threats from scratch, MISP lets you stand on the shoulders of the global security community. When El Machete attacks an organization in Venezuela, the indicators from that attack get shared in MISP and now a security team in Europe can use those same indicators to defend themselves.

This is the power of threat intelligence sharing. And it is why platforms like MISP exist.

For this project, we deployed MISP locally on Ubuntu using Docker meaning we ran our own private instance of the platform, loaded real-world threat feeds into it and used it to investigate El Machete from the ground up.

Setting Up the Environment — Deploying MISP with Docker

One of the most valuable parts of this project was building the environment from scratch. Anyone can read about MISP actually deploying it teaches you something completely different.

Here is how we did it step by step.

Why Docker?

Docker is a containerization platform that lets you run applications in isolated environments called containers. Instead of manually installing MISP and all its dependencies which can take hours and break in unexpected ways Docker packages everything together and runs it with a single command.

For a complex platform like MISP, which depends on a web server, a database, a mail server, Redis, and several modules all working together, Docker makes deployment dramatically simpler and more reliable.

Step 1 — Install Docker on Ubuntu

First we set up Docker’s official repository and installed it:

# Add Docker's official GPG key
 sudo apt-get update
 sudo apt-get install ca-certificates curl
 sudo install -m 0755 -d /etc/apt/keyrings
 sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
 sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add Docker's repository for Ubuntu
 echo \
 "deb [arch=$(dpkg - print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
 https://download.docker.com/linux/ubuntu \
 $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
 sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Update and install Docker
 sudo apt-get update
 sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Notice the difference from Kali Linux — Ubuntu uses its own GPG key URL and repository link. Always make sure you are using the correct repository for your operating system, otherwise Docker will fail to install or update.

Step 2 — Install Git and Clone the MISP Docker Repository

# Install Git
 sudo apt install git
# Clone the MISP Docker repository
 git clone https://github.com/MISP/misp-docker
# Navigate into the directory
 cd misp-docker/
# Copy the template environment file
 cp template.env .env

The template.env file contains all the default configuration settings for your MISP deployment. Copying it to .env activates those settings. You can open it and customize values like admin email and passwords before starting MISP.

Step 3 — Pull and Start MISP

# Pull all required Docker images
 sudo docker compose pull
# Start all containers in the background
 sudo docker compose up -d

If you see this error: Some service image(s) must be built from source Run this command first:

sudo docker compose build misp-modules

Then run docker compose up -d again. This happens because the misp modules image sometimes needs to be compiled locally rather than pulled from the registry. It is completely normal.

Keep running docker compose up -d until all five containers show as healthy. Some containers depend on others being ready first, so it may take a few attempts.

Step 4 — Access MISP in the Browser Once all five containers show as healthy, open your browser and go to:

http://localhost

Login with the default credentials:

• Email: admin@admin.test
• Password: admin

Understanding the Five MISP Containers

When you run docker compose up, five containers start together:

Container Role misp-core -The main MISP web application misp-modules -Enrichment and analysis modules database -Stores all events, attributes and users redis -Handles caching and message queuing mail -Handles email notifications from MISP

All five need to be healthy before MISP works correctly. If any one of them fails, MISP will not load properly.

Full setup guide: https://github.com/MISP/misp-docker

Configuring the Feeds — Where the Real Intelligence Comes From

Installing MISP is just the beginning. The real value comes from the threat intelligence feeds you connect to it. Think of feeds as live streams of threat data coming in from security researchers, CERTs, and organizations around the world.

Without feeds, MISP is an empty database. With feeds, it becomes a powerful threat intelligence platform backed by global security knowledge.

What Are MISP Feeds?

A MISP feed is a structured data source that automatically imports threat indicators into your MISP instance. These indicators could be malicious IP addresses, phishing domains, malware file hashes, command and control server addresses, or URLs used in attack campaigns.

When you enable a feed and cache it, MISP downloads all the associated events and attributes and makes them searchable inside your platform.

Step 1 — Load the Default Feed Metadata

When you first install MISP, no feeds are active. Here is how to enable them:

Log into MISP at http://localhost

Click Sync Actions in the top navigation menu

Select Feeds

Click Load Default Feed Metadata

This populates your feeds list with dozens of well known threat intelligence sources from the security community.

Step 2 — Enable and Cache the First Three Default Feeds

Check the box next to the first three feeds in the list

Click Enable Selected then confirm by clicking Enable Feed

With the same feeds selected click Enable Caching for Selected

Finally click Fetch All Events to import the data

Why enable caching? Caching stores the feed data locally inside your MISP instance so you can search and query it without having to fetch it from the remote source every time. It makes your analysis much faster.

Step 3 — Add a Custom Feed: FireHOL Malicious IPs

Beyond the default feeds, we added a custom feed from FireHOL a well-known project that maintains curated blocklists of malicious IP addresses based on multiple threat intelligence sources.

Why add a custom feed? Default feeds are great, but real threat intelligence work often requires pulling in additional specialized sources depending on what you are investigating. Learning how to add custom feeds is an essential MISP skill.

Here is the configuration we used:

Feed Name: FireHOL Malicious IPs Provider: FireHOL Enabled: Yes Caching Enabled: Yes Input Source: Network URL:https://raw.githubusercontent.com/firehol/blocklistipsets/master/firehol_level1.netset Source Format: Freetext Distribution: Your organisation only

Step 4 — Create a Custom Tag

To keep our data organized and easily searchable, we created a custom tag to label all events imported from the FireHOL feed:

Tag Name: feed-source:firehol Created under: Event Actions → Tag Actions → Add Tag

Tags in MISP work like labels. They let you filter and search events by source, campaign, threat actor, or any category you define. Good tagging practice is what separates a messy MISP instance from a well-organized one.

Step 5 — Verify the Feed Was Imported Correctly

1. Go to Event Actions → List Events
2. Look for the FireHOL Malicious IPs event
3. Click on it to see the Event ID, UUID and the feed-source:firehol tag
4. Go to Event Actions → Search Attributes
5. Paste the UUID into the search field and run the search
6. You should see a list of malicious IP addresses imported from the feed

This verification step is important. It confirms that MISP is not just installed but actually functioning as a live threat intelligence analysis environment ready for real investigation work.

The Investigation Hunting El Machete

This is where the real intelligence work begins. With MISP deployed and feeds configured, we now had access to real-world threat data. Our job was to search through that data, extract indicators linked to El Machete, and build a picture of how this group operates.

How Do You Find a Threat Actor in MISP?

MISP organizes threat data into events. Each event represents a specific incident, campaign, or intelligence report. Inside each event are attributes the actual indicators like IP addresses, domains, file hashes, and URLs.

To find El Machete, we searched MISP events and attributes using the group’s known name and aliases. The search returned three key events that formed the foundation of our investigation:

Event 1552 — OSINT: Sharpening the Machete (CIRCL, 2019) 447 attributes Event 210 — Machete Just Got Sharper (ESET, 2019) 320 attributes Event 1107 — El Machete’s Malware Attacks Cut Through LATAM (CIRCL, 2017) — 285 attributes

These three events alone contained over 1,000 attributes linked to El Machete activity spanning multiple years and multiple campaigns.

What We Extracted — The IOC Summary

From these events we extracted the following categories of Indicators of Compromise:

Destination IPs: 10 Domains: 3 URLs: 9 Filenames: 37 MD5 Hashes: 99 SHA256 Hashes: 57

This spread of indicator types is significant. It means we have network indicators to block at the firewall, delivery infrastructure to monitor at the email gateway, payload names to watch for at the endpoint, and malware fingerprints to load into detection tools.

Breaking Down the Indicators

The IP Addresses

The ten destination IP addresses extracted from MISP are historically associated with El Machete command-and-control infrastructure. These are the servers the malware phones home to — sending stolen data and receiving new instructions.

185.224.137.63 156.67.222.88 158.69.9.209 142.44.236.215 199.79.63.188 109.61.164.33 176.9.3.184 213.239.232.149 69.64.43.33 181.50.98.50

In an operational environment these would be immediately added to firewall blocklists and used to search historical network logs for any signs of past communication.

The Domains and Hostnames

The domains used by El Machete for malware delivery and phishing operations:

tobabean.expert koliast.com artyomt.com

Associated hostnames used for command-and-control:

jristr.hopto.org lawyersofficial.mipropia.com mcsi.gotdns.ch djcaps.gotdns.ch

Notice the use of dynamic DNS services like hopto.org, gotdns.ch, and ddns.net. This is a deliberate choice by the threat actor dynamic DNS lets them change the underlying IP address of their infrastructure without changing the domain name, making it harder to track and block them.

The Malicious URLs

The URLs extracted reveal one of El Machete’s most consistent tactics — crafting download links that look like legitimate government or news documents in Spanish:

**http://actualizacion.esy.es/Mision_Secreta_de_la_DINA_en_Washigton.rar http://cristianoo.esy.es/Padrino_Lopez_Hay_un_golpe_de_Estado_en_desarrollo.zip http://informesanddocumentos.esy.es/semanario_en_marcha_1758_1.zip**

Read those filenames carefully. Secret Mission of DINA in Washington. Padrino Lopez there is a coup in progress. Weekly newspaper.

These are not random file names. They are carefully crafted to make a Venezuelan military officer, government official, or diplomat believe they are opening an urgent official document. This is social engineering at a high level of sophistication.

The Filenames Masquerading in Plain Sight

This is where El Machete’s tradecraft becomes very clear. Look at these filenames found in the MISP data:

GoogleUpdate.exe Chrome.exe GoogleCrash.exe python27.exe 977_REG_IN_CO_012_V1.scr ORDENES_GENERALES.scr Mision_Secreta_de_la_DINA_en_Washigton.scr

Two things are happening here. First, malware is being disguised as familiar software GoogleUpdate, Chrome, Python. These are names a user is unlikely to question. Second, .scr files are being named after official-sounding military and government documents.

A .scr file is a Windows screensaver file but it is also an executable. When a victim double-clicks what they think is a PDF or Word document, they are actually running malware.

The Hashes Evidence of Payload Reuse

We extracted 99 MD5 hashes and 57 SHA256 hashes from the MISP events. But the most analytically significant finding was this the same hashes appeared across multiple separate events.

This means El Machete reused the same malware payloads across different campaigns over multiple years. They did not build fresh tools for each operation. This is important for two reasons:

First, it improves our attribution confidence. Shared malware components are a fingerprint that links campaigns to the same operator.

Second, it means a single set of hash-based detection rules can catch activity across multiple campaigns past, present, and potentially future.

MITRE ATT&CK Mapping — Connecting the Evidence to Real Attacker Behaviour

Finding indicators is one thing. Understanding how an attacker uses them is another. Here is how every IOC we found maps to a real attacker technique.

Initial Access — T1566.001 / T1566.002 (Spear-Phishing) El Machete’s entry point. Malicious .scr files disguised as urgent government documents. The victim opens what looks like an official military order or judicial notice and executes malware.

Execution — T1059.006 / T1218.007 The Machete toolkit runs as a Python process packaged with PyInstaller. Legitimate Windows tools like msiexec.exe and wscript.exe are abused to execute malicious code without triggering basic antivirus.

Persistence — T1053.005 / T1547.001 Scheduled tasks and startup entries keep the malware running across every reboot. El Machete stays inside victim environments for months sometimes years.

Defense Evasion — T1036.005 / T1027 GoogleUpdate.exe. Chrome.exe. Python_27.exe. Names chosen deliberately to blend into a legitimate process list and avoid detection.

Collection — T1056.001 / T1113 / T1125 Keylogging. Screenshots. Webcam and microphone recording. Browser credential theft. Clipboard monitoring. Everything the victim types, sees, or says is captured.

Command and Control — T1071.001 / T1071.002 HTTP and FTP channels communicate with C2 infrastructure the IP addresses and dynamic DNS hostnames extracted from MISP. Standard protocols make the traffic blend in with normal web activity.

Exfiltration — T1041 Stolen intelligence leaves through the same C2 channels. Slow and steady designed to avoid triggering data loss prevention tools.

The Verdict — Threat Assessment

Overall Risk Level: Medium to High

El Machete is not the most technically sophisticated threat actor in the world. They do not use zero-day exploits or cutting-edge malware frameworks. What makes them dangerous is something far harder to defend against patience, persistence, and precision.

They pick their targets carefully. They craft convincing lures in the target’s own language. They stay hidden for months or years. And they keep coming back even after being publicly exposed.

For organizations in government, defense, law enforcement, energy, and telecommunications particularly in Latin America El Machete represents a serious and ongoing threat.

What Should Organizations Watch For?

Emails or downloads containing .scr files disguised as official documents Archive files with Spanish-language government or military themed names Processes named GoogleUpdate.exe, Chrome.exe, or Python_27.exe running from unusual locations Unexpected scheduled tasks or startup entries Outbound FTP or HTTP connections to dynamic DNS domains Any of the IP addresses or domains extracted in this investigation

Lessons Learned

This project was one of the most valuable hands-on experiences in our cybersecurity training so far. Here is what we took away from it.

Threat intelligence is a skill not just a tool MISP is powerful but it does not do the thinking for you. Knowing how to search, correlate, and interpret indicators is what separates a threat intelligence analyst from someone who just runs scans.

Credentialed access changes everything The difference between what you can see from outside a system and what you can see from inside is enormous. The same applies to threat intelligence the more context you have about a threat actor, the better your analysis will be.

Attribution is hard and that is okay We could not formally confirm who is behind El Machete. But analytical assessment based on language, targeting patterns, tools, and TTPs still gives defenders everything they need to protect themselves. Perfect attribution is not required for effective defense.

Threat actors adapt El Machete has been publicly exposed multiple times since 2014. They are still active. This is a reminder that threat intelligence is not a one-time activity it is a continuous process.

The MITRE ATT&CK framework is essential Mapping indicators to ATT&CK techniques transforms raw data into something defenders can actually act on. Every cybersecurity analyst should be fluent in ATT&CK.

Social engineering beats technical sophistication El Machete does not need advanced exploits. A convincing filename in the target’s language is enough to get inside a government network. The human element is always the hardest vulnerability to patch.

Conclusion

El Machete is a reminder that the most dangerous threats are not always the most technically complex. A group operating since 2010, using Python-based spyware and convincing document lures, has successfully penetrated government networks, military systems, and critical infrastructure across Latin America and beyond and is still active today.

This investigation taught us that threat intelligence is about connecting dots. A single IP address means very little. But when you correlate it with domains, filenames, hashes, campaign history, and attacker behaviour a clear picture emerges.

MISP gave us the platform to do that. The MITRE ATT&CK framework gave us the language to communicate it. And the process of deploying, configuring, and operating a real threat intelligence environment gave us something no textbook can hands-on experience.

If you are a cybersecurity student or analyst looking to build practical threat intelligence skills, our recommendation is simple: deploy MISP, load the feeds, pick a threat actor, and start hunting.

The full project including IOC lists, MITRE ATT&CK mapping, and technical documentation is also available on GitHub: https://github.com/Fathiah-0/Threat-Actor-Investigation-Profiling

Thanks for reading. If you found this useful, follow us for more hands-on cybersecurity project writeups.