Mask Spyware Outdoes Flame - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
IT Leadership // IT Strategy
News
2/11/2014
09:58 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Mask Spyware Outdoes Flame

Rare Spanish-speaking cyberespionage campaign uses spyware and malware tools that researchers call the most sophisticated yet.

KASPERSKY LAB SECURITY ANALYST SUMMIT -- Punta Cana, Dominican Republic -- Move over, Flame and Duqu: A newly discovered cyberespionage operation waged by Spanish-speaking attackers against government, energy, oil, and gas organizations around the globe employs the most sophisticated array of tools seen yet, according to researchers here.

Kaspersky Lab researchers disclosed "The Mask" here Monday, an advanced cyberespionage operation that went undetected for about five years, using a rootkit, bootkit, and Windows, Mac OS X, and Linux versions of the malware. There is evidence pointing to Android and iOS versions of the malware, as well, and The Mask also targets government entities, diplomatic offices, and embassies, research institutions, and activists across Europe, the Middle East, Africa, and the Americas, including victims in the US.

Costin Raiu, director of the global research and analysis team at Kaspersky Lab, says a Spanish-speaking cyberespionage attack is unusual. The Mask has all the earmarks of an elite nation-state campaign; sophistication-wise, it basically usurps the Flame campaign associated with Stuxnet. "This is one of the best I have seen. Previously, the best APT group was the one behind Flame, but now that changes my opinion because of the way [Mask operators] manage the infrastructure and the way they react to threats and the speed of reaction and professionalism ... beyond Flame and anything else we have seen so far," he says.

The Mask, a.k.a. Careto, steals documents and encryption keys, VPN configuration information, SSH keys, and Remote Desktop Client files, and wipes log traces of its activity. Another unique feature: It exploits an older vulnerability in Kaspersky's antivirus software.

Read the rest of this story on Dark Reading.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Commentary
What Becomes of CFOs During Digital Transformation?
Joao-Pierre S. Ruth, Senior Writer,  2/4/2020
News
Fighting the Coronavirus with Analytics and GIS
Jessica Davis, Senior Editor, Enterprise Apps,  2/3/2020
Slideshows
IT Careers: 10 Job Skills in High Demand This Year
Cynthia Harvey, Freelance Journalist, InformationWeek,  2/3/2020
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Slideshows
Flash Poll