El_Machete__2019__blog_Sharpening_the_Machete.pdf

ESET describes an active, targeted cyberespionage campaign (Machete) against military and government organizations in Latin America that uses spearphishing with self‑extracting archives to deliver obfuscated Python/py2exe backdoors. The malware family includes downloader, persistence (GoogleCrash.exe), spy (Chrome.exe) and communication (GoogleUpdate.exe) components capable of screenshots, keylogging, browser data theft, geolocation via Mozilla Location Service, collection of GIS and cryptographic files, and exfiltration to FTP/Dropbox/Google Docs or removable drives; more than 50 infected hosts (mostly Venezuelan military) were observed, with gigabytes of data exfiltrated weekly.