The-Mask-has-been-unmasked-again.pdf
Excerpt
Georgy Kucherin & Marc Rivero López
Kaspersky, Russia & Spain
georgy.kucherin@gmail.com
mriverolopez@gmail.com
2 - 4 October, 2024 / Dublin, Ireland
www.virusbulletin.com
THE MASK HAS BEEN UNMASKED AGAIN KUCHERIN & RIVERO LÓPEZ
2 VIRUS BULLETIN CONFERENCE OCTOBER 2024
ABSTRACT
The Mask (also known as Careto) is an advanced threat actor that has been operating since at least 2007. In the past, it was observed to conduct cyber espionage campaigns that mainly targeted high-profile organizations. This actor’s attacks have always been remarkable from the technical perspective, as they commonly involve use of zero-day exploits, bootkits, and modular backdoors for different operating systems.
Over the last decade, The Mask has been doing its best to a…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Virus Bulletin on virusbulletin.com.
More from Virus Bulletin10
- Google-Calendar-as-C2-infrastructure-a-China-nexus-campaign-with-stealthy-tactics.pdfVirus Bulletin · Added 24 Mar
- Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdfVirus Bulletin · Added 29 Jan
- DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdfVirus Bulletin · Added 16 Oct 2025
- Sugarcoating-KANDYKORN-a-sweet-dive-into-a-sophisticated-MacOS-backdoor.pdfVirus Bulletin · Added 15 Jan 2025
On the same topics
- Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeGroup-IB · Published 21 Oct
- Resources - SecurityScorecardSecurityScorecard · Added 25 Oct
- ARMORY CASTLE Exploits BeyondTrustMandiant (Google) · Published 15 Oct
- skanthak.homepage.t-online.de/sentinel.htmlskanthak.homepage.t-online.de · Added 18 Oct
