'Machete' cyber-espionage group goes after military in Venezuela

The group, dubbed "Machete by ESET, has been known to hit many Latin American countries.

In March, there were massive, days-long power outages in Venezuela, causing several fatalities and pushing the South American country into turmoil that has continued to the present day.

Around the same time as the first outages, a cyber-espionage group — dubbed “Machete” by ESET — began siphoning off gigabytes of confidential documents from Venezuela’s military in a successful campaign that is ongoing, according to new research from ESET.

While there are some compromised computers in Ecuador, Colombia, and Nicaragua, the primary focus is Venezuela, as over half of the compromised computers in the campaign belong to the Venezuelan military, according to the Slovakian cybersecurity company.

ESET researchers write that until May of this year, more than 50 computers were actively communicating with the attackers’ command and control server and bleeding gigabytes-worth of data each week.

The toolset used by Machete is capable of stealing documents commonly used in the office suite, but also those created using geographic information systems (GIS) software, ESET researchers write.

The primary interest of the attackers was Venezuelan military grids, positioning, and navigation routes.

Although the actors’ identities remain unknown, Machete has long been used in campaigns against Latin American countries. Machete has been active since 2010 with targets all around the world, including Peru, Argentina, Bolivia, Mexico, Cuba, England, Germany, Spain, Ukraine, Canada, the U.S., and Russia, according to previous research from Kaspersky and Cylance.

The group’s particular experience in targeting Latin American countries seems to be playing to their advantage here, ESET researchers note. Their background running attacks in Latin American countries “has allowed them to collect intelligence and refine their tactics over the years,” the researchers write. “They know their targets, how to blend into regular communications, and which documents are of the most value to steal.”

Of particular note, the people responsible for these attacks are believed to have physical access to compromised computers in at least one country in the campaign, given that some of the code the attackers use is code used to exfiltrate data to removable drives, according to ESET. They are also believed to be Spanish-speaking.

The group works at being inconspicuous, according to ESET. The attacks start with phishing emails that contain an attachment or link containing a compressed self-extracting archive that runs malware once its opened. In order to disguise the malware, some of the attachments are legitimate decoy documents stolen from other victims. They also use military jargon and etiquette specific to Venezuela’s military so nothing appears amiss.

ESET researchers warn the group’s ongoing attack is malleable and quick to change.

“The Machete group is operating more strongly than ever, even after researchers have published technical descriptions and indicators of compromise for this malware,” researchers write. “ESET has been tracking this threat for months and has observed several changes, sometimes within weeks.”

AI, voting machine conspiracies fill information vacuum around Venezuela operation 

After the U.S. capture of Nicolás Maduro, fake AI-driven media quickly flooded the internet, while Trump allies revived debunked theories of rigged voting machines.  

Hacking group focused on Central America dumps 10 terabytes of military emails, files

Researchers detail Russia-linked group’s cyber-espionage tactics in Ukraine

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure