Rare Spanish-speaking cyberespionage campaign uses spyware and malware tools that researchers call the most sophisticated yet.
KASPERSKY LAB SECURITY ANALYST SUMMIT -- Punta Cana, Dominican Republic -- Move over, Flame and Duqu: A newly discovered cyberespionage operation waged by Spanish-speaking attackers against government, energy, oil, and gas organizations around the globe employs the most sophisticated array of tools seen yet, according to researchers here.
Kaspersky Lab researchers disclosed "The Mask" here Monday, an advanced cyberespionage operation that went undetected for about five years, using a rootkit, bootkit, and Windows, Mac OS X, and Linux versions of the malware. There is evidence pointing to Android and iOS versions of the malware, as well, and The Mask also targets government entities, diplomatic offices, and embassies, research institutions, and activists across Europe, the Middle East, Africa, and the Americas, including victims in the US.
Costin Raiu, director of the global research and analysis team at Kaspersky Lab, says a Spanish-speaking cyberespionage attack is unusual. The Mask has all the earmarks of an elite nation-state campaign; sophistication-wise, it basically usurps the Flame campaign associated with Stuxnet. "This is one of the best I have seen. Previously, the best APT group was the one behind Flame, but now that changes my opinion because of the way [Mask operators] manage the infrastructure and the way they react to threats and the speed of reaction and professionalism ... beyond Flame and anything else we have seen so far," he says.
The Mask, a.k.a. Careto, steals documents and encryption keys, VPN configuration information, SSH keys, and Remote Desktop Client files, and wipes log traces of its activity. Another unique feature: It exploits an older vulnerability in Kaspersky's antivirus software.
Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
How Enterprises Are Attacking the IT Security EnterpriseTo learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
IT Strategies to Conquer the CloudChances are your organization is adopting cloud computing in one way or another -- or in multiple ways. Understanding the skills you need and how cloud affects IT operations and networking will help you adapt.