Metador APT: The Hidden Threat Inside Telcos and ISPs

By Sophia Britt

Updated Oct 7, 2026Published Nov 2, 20229 min read

Metador is an advanced persistent threat (APT) group disclosed by SentinelLabs in September 2022. Metador spied on telecommunications companies, internet service providers and universities in the Middle East and Africa using two in-memory Windows malware platforms, metaMain and Mafalda. As of SentinelLabs’ April 2025 update, the group remains unattributed.

In September 2022, researchers at SentinelLabs, the research arm of SentinelOne, disclosed Metador, a previously unknown advanced persistent threat (APT) that had been operating inside telecommunications companies, internet service providers (ISPs) and universities in the Middle East and Africa. According to SentinelLabs, Metador used custom-built Windows malware platforms that run in memory, and managed carefully segmented infrastructure for each victim.

Security Affairs, reporting the SentinelLabs research in September 2022, said the group had been targeting ISPs and telecoms for about two years before it was exposed. The discovery drew wide attention in the security industry because the group could not be linked to any known actor. ISP security solutions are one category of defense aimed at intruders like this; the discovery has been compared to a shark fin breaching the water’s surface.

What is an APT

The unfortunate fact is that software will always contain exploits. Though this could keep the anxious security professional up at night, the industry’s saving grace is that most attackers operate under motivations that are mercifully simple.

Financial aims, for instance, drive attackers towards a quantity over quality approach. The weakest organizations may have unpatched vulnerabilities that stretch back decades; it’s these that automated attacks and hungry criminals will gladly strip bare. For most organizations, their defenses continue to be just good enough to avoid low-effort exploitation.

Advanced Persistent Threat (APT) actors turn this good-enough mentality on its head: these attackers use state-of-the-art, continuous access techniques to not only gain access to a system, but remain inside, completely undetected for prolonged periods of time.

APT attackers are often motivated politically, with many groups funded or operating directly under the commands of national governments. These groups undertake defined cybersec operations that push the objectives of the supporting country.

Introducing Metador

In research presented at the first LABScon conference in Arizona in September 2022, SentinelLabs reported that a number of ISPs, telecommunications providers and universities were hosting unique malware strains whose aim appeared to be persistent espionage. These instances were found primarily in African and Middle Eastern providers.

The tools in use were an eclectic mix of older, rudimentary techniques, alongside highly agile and industry-savvy implementation. The group’s two main tools were metaMain and Mafalda, and SentinelLabs also found indications of an additional Linux implant. These are two custom-built malware platforms, aimed at Windows OS, which support vast swathes of escalation and payload detonation techniques.

MetaMain, the first of these, represents a feature-rich platform that aims to support and enforce long-term access. This also allowed for Metador to log keystrokes, transfer and execute files between systems, and execute shellcode. Finally, MetaMain acts as an auxiliary program to deploy Mafalda.

Mafalda represents Metador’s creme de la creme. This flexible, interactive implant supports 67 commands in its newer variant, up from 54 in an earlier one, according to SentinelLabs, which also noted that Mafalda was still being actively developed as late as December 2021. Metador’s expertise is reflected in their malware infrastructure, too. Both platforms are loaded directly into memory rather than run from files on disk, which makes them harder for native security tools to detect; Security Affairs reported that the attackers used the Windows debugging tool cdb.exe to decrypt and load the malware.

Alongside this, throughout Metador’s already extensive victim list, the operators used carefully segmented infrastructure, typically a single external IP address per victim network, with command-and-control servers hosted on a Dutch provider called LITESERVER. Segmenting infrastructure this way reduces the risk that detection at one victim leads researchers to the others.

SentinelLabs also reported that the operators quickly deployed intricate countermeasures when security solutions appeared on a victim network, and that newer Mafalda variants were more heavily obfuscated to thwart analysis.

Metador: Still a Mystery

Although many APTs are linked to governments, SentinelLabs had still not attributed Metador to any country or known group in its research, which was last updated in April 2025; the researchers suggested state espionage or a high-end contractor arrangement as possibilities. The name originates from a line included in the code, which stated “I am meta”; the second half of the name reflects clues that the devs, or attackers, could speak Spanish.

Cultural references and languages in the code, ranging from English and Spanish to British pop-punk lyrics and Argentinian political content, suggest that multiple developers worked on the malware during its lifespan. Finally, despite a lack of discovered examples, the current software’s version history suggests a timeline of development that extends far longer than researchers have discovered.

Metador continues to baffle researchers. Despite the utmost care being displayed, the operators don’t seem to particularly care whether their victims are compromised by other attacking groups. SentinelLabs described one telecoms victim as a “magnet of threats” that hosted nearly ten known threat actors of Chinese and Iranian origin, including Moshen Dragon and MuddyWater.

This is rare for APTs to allow cross-contamination of their victims: deconfliction is a process that usually runs just before deployment. This checks for the presence of other malware, and – if detected – shuts the attack down. The philosophy behind this is that, the more groups latching onto a target, the more likely the victim will be alerted to an attack.

Furthermore, it also increases the risk of infighting or theft between attacking groups. It’s possible for one attacker to steal the code, or related information, employed by other APTs. Metador appear not to care about these risks, however.

An IPS for ISPs

Internet service providers manage huge swathes of personal information, alongside supporting millions of customers. This makes them particularly alluring targets, as they are fantastic platforms for supply chain and large scale spyware attacks.

ISP infrastructure must evolve with attackers, and well-resourced APTs require layered, modern defenses. A major part of this is data and network visibility. Cloud-based and hybrid platforms make visibility harder for security teams, because it can be difficult to discover the remote resources that specific cloud-based operations call.

Cutting-edge security solutions provide automated data discovery and classification tools, which allow you to thoroughly assess your organization’s risk, alongside freeing up working hours that would be spent combing through assets. From edge devices used by remote-working employees, to core on-premise networks reserved for the highest level of security, your asset detection system must match your organization’s architecture exactly.

Alongside actively monitoring the state of your organization’s data, it’s vital that your security solution provider has a comprehensive and adaptive intrusion detection system. Perimeter-based security alone does not stop an attacker who is already inside the network, which is why many organizations add Intrusion Prevention Systems (IPS) that sit in-line and can block detected intrusions.

These automated systems focus on network and application behavior, not just pre-existing malware signatures. Anomaly-based detection improves the chance that novel attacks, including those from groups such as Metador, are spotted and blocked, although it can produce false positives and no single tool guarantees detection.

Metador at a Glance

What Is an Advanced Persistent Threat?

An advanced persistent threat (APT) is a stealthy attacker, typically a state or state-sponsored group, that gains unauthorized access to a computer network and stays undetected for an extended period. According to Wikipedia’s summary of the term, it was coined in 2006 by Colonel Greg Rattray of the United States Air Force.

The three words describe the attacker: advanced means sophisticated techniques and state-level resources, persistent means long-term access with a specific goal rather than opportunistic theft, and threat means a capable, funded and organized human operator. Well-known APT groups include Cozy Bear and Fancy Bear (linked to Russia), Volt Typhoon and Salt Typhoon (linked to China), Charming Kitten and MuddyWater (linked to Iran), and Lazarus Group and Kimsuky (linked to North Korea).

How Does an APT Attack Unfold?

Mandiant’s 2013 research described seven stages that most APT intrusions follow:

1. Initial compromise, often through spear phishing.
2. Establishing a foothold.
3. Escalating privileges.
4. Internal reconnaissance.
5. Moving laterally to other systems.
6. Maintaining presence.
7. Completing the mission, such as stealing data.

Two of these stages are covered in more depth in the guides to protecting employees from spear phishing and preventing lateral movement in cyber attacks.

How Long Do APTs Stay Hidden?

Dwell time is the number of days an attacker is present in a network before being detected. According to Mandiant’s M-Trends 2026 report, which covers investigations in 2025, the global median dwell time rose to 14 days from 11 days a year earlier. For cyber-espionage and North Korean IT worker incidents, the median was 122 days, which shows why espionage groups such as Metador are so hard to catch.

The same report found that 52% of malicious activity was detected internally in 2025, up from 43% in 2024, and that exploits were the most common initial infection vector for the sixth year in a row, at 32% of intrusions.

IDS vs IPS: Which Does an ISP Need?

An intrusion detection system (IDS) watches a network or host and raises an alarm when it sees a suspected intrusion, while an intrusion prevention system (IPS) sits in-line and can actively block the traffic, for example by dropping packets or blocking an IP address. The US National Institute of Standards and Technology covers both in its guide NIST SP 800-94.

Network-based systems (NIDS) analyze traffic across a whole subnet, while host-based systems (HIDS) run on individual devices. Against memory-resident malware such as metaMain and Mafalda, host-level monitoring matters because little may be written to disk; the guide to unified endpoint security and management explains that side.

How Can Telcos and ISPs Defend Against Groups Like Metador?

1. Patch exposed systems quickly. Exploits were the top initial infection vector in M-Trends 2026.
2. Build internal detection. Mandiant found that a larger share of intrusions is now detected internally rather than reported by outsiders.
3. Combine signature and anomaly detection. Signatures catch known malware; behavior-based monitoring is needed for custom tools like Mafalda.
4. Watch for misuse of legitimate tools. Metador loaded its malware through the Windows debugger cdb.exe.
5. Assume you are not the only intruder. The Metador victim also hosted nearly ten other known threat actors, so one clean-up rarely finds everything.

For the basics behind these steps, see what you should know about network security.

Written bySophia Britt

Sophia Britt has published 277 articles on Justwebworld since 2021, mostly covering Tech, Business and Digital.

More from Sophia Britt →

Justwebworld has published guides since 2012. How we write and update articles · Report an error

Powered by