The security company Kaspersky has published a detailed report concerning the advanced cyber espionage campaign named “The Mask” or otherwise “Careto”.
According to researchers, the campaign has been ongoing since at least 2007, and mainly targets government agencies, energy companies, and other high-profile organizations.
The campaign relies on carrying out attacks using the APT (Advanced Persistent Threat) methodology and so far counts more than 380 high-profile victims in 31 countries.
Several victims have been identified in France, Germany, Spain, Switzerland, Turkey, Belgium, China, Brazil, Egypt, Iran, Iraq, Malaysia, Mexico, Norway, Poland, Spain, United Kingdom and the USA.
Particular interest is caused by the fact that the criminals behind the campaign are Spanish-speaking, given that the Spanish language has rarely been associated with advanced threats.
The attackers have sophisticated tools to carry out attacks, including a bootkit and a rootkit, malware for Mac OS X and Linux, as well as a variant of the threat designed for Android and iOS.
The malicious software is distributed with the help of spear – phishing emails, which direct users to websites where exploit kits are hosted.
The main goal of criminals is the interception of sensitive information from the networks of government organizations, energy companies, oil and natural gas, diplomatic offices and embassies, research organizations, and even activists.
«Many reasons lead us to believe that behind the campaign there could be a state or a nation», said a spokesperson for Kaspersky Lab .
«First of all, we observed a very high level of professionalism in the operations carried out by the team, which acted with absolute precision and took all necessary measures so as not to leave any traces behind. This level of security is not normal for the usual cybercrime groups.
