CaretoThreat actor
- the mask
- ugly face
This threat actor targets governments, diplomatic missions, private companies in the energy sector, and academics for espionage purposes. The Mask is an advanced threat actor that has been involved in cyber-espionage operations since at least 2007. The name "Mask" comes from the Spanish slang word "Careto" ("Ugly Face" or “Mask”) which the authors included in some of the malware modules.From MISP Galaxy
Last reported 4 years ago, by Elastic Security Labs1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1055Process Injection
“We do not simply rely on naïve approaches like monitoring well-known system call sequences for process injection, but efficiently analyze memory to find all known evasion capabilities.”
- T1055.004Asynchronous Procedure Call
“It then periodically wakes up, using an asynchronous procedure call, and executes a ROP chain to mark its payload as executable before jumping to it.”
- T1055.012Process Hollowing
“PROCESS HOLLOWING”
What the reports say
1 report, newest first · the exact sentence from each-
Hunting In Memory“More recently, Careto and Odinaff malware families have used module overwriting techniques.”
Thanks — we review every report.