An emerging threat group dubbed Metador has been explicitly targeting universities, telecommunication companies, and internet service providers throughout Africa and the greater Middle East. Metador, named after a code signature in one (1) of their attacks, is an up-and-coming threat group believed to be conducting collection operations on behalf of a nation state, but have yet to be attributed to a specific country. Attributed malicious programs utilized by Metador include “metaMain” and “Mafalda” which operate solely within Windows memory space and never write to the disk, making discovery difficult for anti-virus defenses. Additional payloads uncovered from Metador attacks are “CryShell”, a network connection bouncer for command-and-control (C2) communications, and an unnamed Linux malware which routes pilfered materials from machines to Mafalda. While Metador has not been attributed to a country or government entity at this time, indicators reveal the threat actors are fluent in English and Spanish and make references to British punk music and Argentinian political animations. CTIX will continue to monitor activity surrounding the Metador group and other threat organizations worldwide providing updates accordingly.