The Mask

  • First known sample

    2007

  • Discovery

    2013

  • Number of targets

    100-1000

  • Current status

    Inactive since 2014

  • Type

    Cyberespionage toolkit

  • Targeted platforms

    OS X , Windows

  • TOP targeted countries

    Brazil , France , Iran , Libya , Morocco , Spain , Switzerland , Ukraine

  • The way of propagation

    Social engineering

  • Purpose/Functions

    Cyberespionage
  • Special features
    The attackers use a very complex toolset that includes an extremely sophisticated piece of malware, a rootkit, a bootkit, Mac OS X and Linux versions and possibly versions for Android and iPad/iPhone (iOS).

  • Targets

    Academia/Research , Activists , Diplomatic organizations/embassies , Government entities , Private companies
  • Artefacts/Attribution
    Clues such as the use of the Spanish language are weak, as it is spoken in many countries, including Latin America, Mexico and the USA (for instance in Miami, where a strong Spanish-speaking community exists).
  • Description

    A highly sophisticated threat actor involved in cyber-espionage campaigns from 2007 to 2014 and known for its advanced toolkit. This group targeted representatives of the government, diplomatic embassies, energy industry, and research institutions around the globe. Targets were infected via spear-phishing emails with links to a malicious website; once inside the system, all communications channels were intercepted, and detection was extremely difficult because of the toolkit’s stealth abilities.

    Additional information

© 2023 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com