Mask Spyware Outdoes Flame - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
IT Leadership // IT Strategy
News
2/11/2014
09:58 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Mask Spyware Outdoes Flame

Rare Spanish-speaking cyberespionage campaign uses spyware and malware tools that researchers call the most sophisticated yet.

KASPERSKY LAB SECURITY ANALYST SUMMIT -- Punta Cana, Dominican Republic -- Move over, Flame and Duqu: A newly discovered cyberespionage operation waged by Spanish-speaking attackers against government, energy, oil, and gas organizations around the globe employs the most sophisticated array of tools seen yet, according to researchers here.

Kaspersky Lab researchers disclosed "The Mask" here Monday, an advanced cyberespionage operation that went undetected for about five years, using a rootkit, bootkit, and Windows, Mac OS X, and Linux versions of the malware. There is evidence pointing to Android and iOS versions of the malware, as well, and The Mask also targets government entities, diplomatic offices, and embassies, research institutions, and activists across Europe, the Middle East, Africa, and the Americas, including victims in the US.

Costin Raiu, director of the global research and analysis team at Kaspersky Lab, says a Spanish-speaking cyberespionage attack is unusual. The Mask has all the earmarks of an elite nation-state campaign; sophistication-wise, it basically usurps the Flame campaign associated with Stuxnet. "This is one of the best I have seen. Previously, the best APT group was the one behind Flame, but now that changes my opinion because of the way [Mask operators] manage the infrastructure and the way they react to threats and the speed of reaction and professionalism ... beyond Flame and anything else we have seen so far," he says.

The Mask, a.k.a. Careto, steals documents and encryption keys, VPN configuration information, SSH keys, and Remote Desktop Client files, and wipes log traces of its activity. Another unique feature: It exploits an older vulnerability in Kaspersky's antivirus software.

Read the rest of this story on Dark Reading.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Commentary
Enterprise Guide to Digital Transformation
Cathleen Gagne, Managing Editor, InformationWeek,  8/13/2019
Slideshows
IT Careers: How to Get a Job as a Site Reliability Engineer
Cynthia Harvey, Freelance Journalist, InformationWeek,  7/31/2019
Commentary
AI Ethics Guidelines Every CIO Should Read
Guest Commentary, Guest Commentary,  8/7/2019
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
Data Science and AI in the Fast Lane
This IT Trend Report will help you gain insight into how quickly and dramatically data science is influencing how enterprises are managed and where they will derive business success. Read the report today!
Slideshows
Flash Poll