{
  "family": "metel",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Metel (also known as Corkow) is a highly sophisticated, multi-stage Banking Trojan and APT-style framework that achieved massive notoriety in 2015 for executing targeted attacks directly against banking infrastructure. Unlike traditional banking trojans that target the bank's customers (e.g., via web injects), Metel targets the bank's internal network to gain control of domain controllers and internal payment processing systems, ultimately enabling massive, automated ATM cash-outs (`T1486`).<br><br><b>Understanding Metel (Bank Backend Compromise)</b><br>To an infected endpoint within a bank, Metel initially operates like a stealthy backdoor. For a financial security operations center (SOC), a Metel infection is a catastrophic event indicating a 'bank heist' in progress. The attackers use the initial infection to map the network, escalate privileges, and specifically target administrators who manage card processing or ATM networks.<br><br><b>Execution and Jackpotting Mechanics</b><br>Metel is typically introduced via spear-phishing (`T1566.001`) targeting bank employees. The initial payload is heavily obfuscated and establishes deep persistence. Once inside, the operators manually drive the infection, moving laterally (`T1021`) to locate the servers controlling ATM networks. The most notorious capability of Metel is manipulating the backend transaction processing: when money is withdrawn from an ATM using a specific card, Metel intercepts the transaction confirmation on the bank's internal network and forces the system to automatically 'rollback' the transaction balance. This allows the physical 'money mules' at the ATM to withdraw infinite cash while the account balance remains unchanged.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is multi-million dollar financial theft directly from the bank's reserves. Host-based IoCs are complex due to the bespoke nature of the attacks but often involve the presence of custom Mimikatz (`T1003.001`) modules for credential theft, and modified administrative tools (like PsExec) used for lateral movement. Network IoCs include anomalous internal traffic routing toward payment processing VLANs and unexpected administrative logins to critical financial servers from standard workstations.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1021",
    "T1003.001",
    "T1486"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (Often mischaracterized; primary impact is financial theft via ATM jackpotting)",
      "tactic": "Impact"
    },
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory (Stealing Domain Admin credentials)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1021",
      "name": "Remote Services (Lateral movement to payment servers)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately sever the affected internal network segments from the core payment processing and ATM management VLANs.",
    "Initiate a massive credential reset for all Domain Administrators and highly privileged service accounts associated with payment processing.",
    "Hunt for custom memory-resident backdoors and unauthorized usage of administrative tools (PsExec, WMI) across the domain.",
    "Engage specialized Incident Response and coordinate with law enforcement and financial regulatory bodies immediately."
  ],
  "what_to_avoid": [
    "Do not assume the attack is isolated to a single endpoint; Metel operators always seek Domain Admin privileges.",
    "Avoid restoring critical financial servers from backups without ensuring the backups are not also compromised by the persistent backdoor."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}