Kaspersky describes MATA as a multi-platform malware framework used since at least April 2018 to infiltrate corporate environments across Windows, Linux, and macOS systems. The Windows toolchain includes a loader that decrypts a next-stage payload, an orchestrator that can read AES-encrypted configuration from the registry, and plugins loaded from disk, HTTP/HTTPS servers, or MataNet connections. The excerpt shows operators using WMI-linked execution for lateral movement and finding the orchestrator inside lsass.exe on victim machines. MATA’s plugins support command and PowerShell execution, process control, TCP checks, HTTP proxying, file collection and wiping, timestomping, DLL injection, and encrypted TLS/RC4 command-and-control traffic.