metador_An_Unattributed_Threat_Hiding_in_Telcos_SPs_and_Universities.pdf

### Executive summary: SentinelLabs describes a previously undocumented advanced threat actor named "Metador" that targets telcos, ISPs, and universities in the Middle East and Africa using in-memory Windows implants (metaMain and Mafalda), port-knocking/forwarding infrastructure (Cryshell), and sophisticated anti-analysis techniques; the report includes technical execution flows, 60+ Mafalda commands, IOCs (file hashes, C2 IPs/domains), and limited attribution indicators suggesting multilingual developers and contractor-style operations.