The Mask
Also known asCareto · Mask · Ugly Face
Summary
One of the most sophisticated APTs ever observed according to Kaspersky — went undetected for seven years targeting 380+ victims across 30+ countries. Operates multi-platform implants (Windows, macOS, Linux) capable of exfiltrating PGP keys, SSH credentials, VPN configs, and intercepting VoIP/network traffic. After a decade of silence, resurfaced in 2024 with entirely new TTPs including MDaemon email server compromise, HitmanPro Alert driver abuse for privilege escalation, and Google Drive-based C2. Spanish-language artefacts throughout code ('careto' = 'mask' in Spanish). Attribution to a specific nation remains unconfirmed but state-sponsorship is assessed with high confidence given the operational sophistication and target selection (diplomatic missions, government agencies, energy companies).
Attribution
Kaspersky has not published an attribution
Hedged, circumstantial or press-only reporting; not established.
- TechCrunch (Press, 2025-05-23)
Former Kaspersky researchers say the company concluded it worked for Spain; Kaspersky never said so publicly
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Early-2024 FakeHMP deployment via Google UpdaterASSESSED | 2024 | Unknown | Kaspersky GReAT (2024-12-12) — hmpalert.sys driver abused to load FakeHMP on an unidentified victim, launched via a Google Updater technique, early 2024 | |
| Latin American organisation — Careto2/Goreto (2019) and MDaemon WorldClient / FakeHMP (2022)ASSESSED | 2019 – 2022 | Latin America | Government | Kaspersky GReAT (2024-12-12, VB2024 talk) — same Latin American organisation hit with Careto2 & Goreto in 2019 and via its MDaemon server (WorldClient extension, hmpalert.sys/FakeHMP lateral spread) in 2022; attribution medium-to-high confidence |
| Global Diplomatic Espionage | 2007 – 2014 | Middle East, EU, Latin America, Africa | Government, Diplomatic, Energy | Kaspersky GReAT (2014-02-10) — Careto FAQ: active since at least 2007; 380+ unique victims across 1000+ IPs in 31 countries |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 7
| Initial Access1 | T1566.002Spearphishing Link |
|---|---|
| Persistence2 | T1547.015Login ItemsT1546.008Accessibility Features |
| Discovery1 | T1012Query Registry |
| Collection1 | T1005Data from Local System |
| Exfiltration2 | T1020Automated ExfiltrationT1567Exfiltration Over Web Service |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| Careto | Multi-platform Backdoor | Windows/macOS/Linux |
| FakeHMP | Privileged Implant (HitmanPro driver abuse) | Windows |
| Careto2 | Modular Framework (VFS) | Windows |
| Goreto | Go-based C2 Framework | Windows |
Infrastructure patterns
- Exploit sites with sub-domains mimicking sections of Spanish and international newspapers (Kaspersky, 2014)