{
  "family": "metel",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Metel (also known as Corkow) is a highly sophisticated, multi-stage Banking Trojan and APT-style framework that achieved massive notoriety in 2015 for executing targeted attacks directly against banking infrastructure. Unlike traditional banking trojans that target the bank's customers (e.g., via web injects), Metel targets the bank's internal network to gain control of domain controllers and internal payment processing systems, ultimately enabling massive, automated ATM cash-outs (`T1486`).<br><br><b>Understanding Metel (Bank Backend Compromise)</b><br>To an infected endpoint within a bank, Metel initially operates like a stealthy backdoor. For a financial security operations center (SOC), a Metel infection is a catastrophic event indicating a 'bank heist' in progress. The attackers use the initial infection to map the network, escalate privileges, and specifically target administrators who manage card processing or ATM networks.<br><br><b>Execution and Jackpotting Mechanics</b><br>Metel is typically introduced via spear-phishing (`T1566.001`) targeting bank employees. The initial payload is heavily obfuscated and establishes deep persistence. Once inside, the operators manually drive the infection, moving laterally (`T1021`) to locate the servers controlling ATM networks. The most notorious capability of Metel is manipulating the backend transaction processing: when money is withdrawn from an ATM using a specific card, Metel intercepts the transaction confirmation on the bank's internal network and forces the system to automatically 'rollback' the transaction balance. This allows the physical 'money mules' at the ATM to withdraw infinite cash while the account balance remains unchanged.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is multi-million dollar financial theft directly from the bank's reserves. Host-based IoCs are complex due to the bespoke nature of the attacks but often involve the presence of custom Mimikatz (`T1003.001`) modules for credential theft, and modified administrative tools (like PsExec) used for lateral movement. Network IoCs include anomalous internal traffic routing toward payment processing VLANs and unexpected administrative logins to critical financial servers from standard workstations.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Metel and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Metel is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Metel establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Metel typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Metel compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Metel should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Metel?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Metel frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Metel across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Metel by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1021",
    "T1003.001",
    "T1486"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (Often mischaracterized; primary impact is financial theft via ATM jackpotting)",
      "tactic": "Impact"
    },
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory (Stealing Domain Admin credentials)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1021",
      "name": "Remote Services (Lateral movement to payment servers)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately sever the affected internal network segments from the core payment processing and ATM management VLANs.",
    "Initiate a massive credential reset for all Domain Administrators and highly privileged service accounts associated with payment processing.",
    "Hunt for custom memory-resident backdoors and unauthorized usage of administrative tools (PsExec, WMI) across the domain.",
    "Engage specialized Incident Response and coordinate with law enforcement and financial regulatory bodies immediately."
  ],
  "what_to_avoid": [
    "Do not assume the attack is isolated to a single endpoint; Metel operators always seek Domain Admin privileges.",
    "Avoid restoring critical financial servers from backups without ensuring the backups are not also compromised by the persistent backdoor."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}