Loading story…
The Careto (also known as The Mask) threat actor conducted a long-running cyber-espionage campaign that targeted government, diplomatic, energy, research, private equity, and activist organizations in at least 31 countries. Researchers linked the operation to more than 1,000 IP addresses and identified at least 380 unique victims. Initial compromise commonly began with spear-phishing emails that directed targets to malicious websites exploiting vulnerabilities such as Adobe Flash Player CVE-2012-0773, alongside social-engineering lures involving fake Java and Chrome plugin updates.
The malware platform was notably advanced and modular, with Windows and Mac OS X implants, rootkit and bootkit functionality, and suspected Linux and mobile components. It was designed to steal sensitive files and credentials, including encryption keys, VPN configurations, SSH keys, RDP files, and a wide range of documents, while also using stealth techniques that included a customized attack against older Kaspersky products. Kaspersky reported that the group’s known command-and-control infrastructure went offline after January 2014 and said it sinkholed several servers for telemetry, detecting known samples as Trojan.Win32/Win64.Careto.* and Trojan.OSX.Careto.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Securelist published a frequently asked questions article summarizing known details of the Careto campaign, including at least 380 unique victims across 31 countries and more than 1,000 observed IP addresses. The post also noted Kaspersky detection names for known variants.
During the campaign, victims were infected through spear-phishing emails linking to malicious websites that served exploits, including Adobe Flash Player CVE-2012-0773, along with social-engineering lures involving Java and Chrome plugin installation. The malware platform included advanced Windows and Mac OS X implants, with suspected Linux and mobile components.
Kaspersky reported that all known Careto command-and-control servers were offline after January 2014, indicating the operators shut down their infrastructure. Kaspersky also sinkholed several servers to collect telemetry on the campaign.
Kaspersky described Careto (also known as The Mask) as a highly sophisticated cyber-espionage threat actor active since at least 2007. The campaign targeted government, diplomatic, energy, research, private equity, and activist entities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourceschneier.com
Open sourcemashable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky researchers reported that **Careto** (also known as **The Mask**), a sophisticated cyber-espionage group believed dormant since 2014, has continued operating through at least 2024. Newly linked intrusions were identified in **2019**, **2022**, and **January 2024**, including a 2022 breach of a Latin American organization via an **MDaemon** email server and deployment of a malware implant dubbed **FakeHMP**. The newer operations abused the legitimate `hmpalert.sys` driver to load a malicious `hmpalert.dll` for persistence, keylogging, screenshot capture, command execution, and cloud exfiltration through **OneDrive**; other components stole browser, messenger, and organizational files, while a separate DLL covertly recorded microphone audio and uploaded MP3 files to **Dropbox**. A distinct 2019 intrusion used the **Careto2** and **Goreto** frameworks, COM hijacking for persistence, modular plugins, and **Google Drive** for command-and-control and data theft. The activity was tied to the historic Careto operation with medium to high confidence based on overlaps in victimology, filenames, plugin naming, modular design, and persistence techniques seen in the group’s earlier campaigns targeting governments, embassies, diplomatic entities, energy firms, research institutions, and activists across **31 countries**. TechCrunch separately reported that several former Kaspersky employees believed with high confidence that Careto was run by hackers working for the **Spanish government**, though Kaspersky did not publicly make that attribution and Spain declined to comment. The group’s malware has been noted for broad surveillance capabilities across **Windows, macOS, and Linux**, including theft of keystrokes, files, cookies, browsing histories, **PGP** keys, VPN configurations, screenshots, and microphone audio, with **Cuba** described as a particularly significant historical target.
Aug 15, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Researchers linked an exposed directory on infrastructure in Kazakhstan to a credential-stealing malware operation built around a heavily obfuscated **SectopRAT**/**ArechClient2** variant. The investigation tied suspicious IP overlap to malware samples that unpacked through a multi-stage chain involving legitimate Microsoft-signed binaries, a QSetup-based installer, an AutoIt stage, and a final obfuscated .NET payload. The malware checked for **Avast** and **AVG** processes, reconstructed and launched a legitimate **AutoIt3** executable, injected code into `jsc.exe`, and communicated with command-and-control infrastructure over TCP port `15647`. Recovered functionality and strings indicated the payload fingerprints infected systems and steals credentials and other sensitive data. The campaign was also linked to fake software download pages promoted through **Google Ads**, including a malicious **OBS** installer archive, and researchers estimated the operation may have affected more than **18,000** victims based on files found in the exposed log directory. Separate analysis of newer SectopRAT samples showed the malware had evolved its evasion and communications methods by moving the real command-and-control address out of the class previously used for static extraction, replacing it with `127.0.0.1`, and adding new configuration fields such as a **build ID** and an encryption key for command-and-control traffic. One analyzed sample identified itself as **Build 3**, indicating continued development of the malware family.
Aug 15, 2026