Kaspersky Labs has revealed details of Careto/The Mask, a complex advanced persistent threat (APT) that has been running since 2007. The Mask is highly complex and uses a sophisticated set of tools including malware, rootkits and bootkits to infect Windows, OS X and Linux machines.
Kaspersky first noticed The Mask when it observed attempts by the malware used to hide itself from Kaspersky Lab products by attempting to exploit vulnerabilities in those programs. Those vulnerabilities where fixed five years ago and Kaspersky has been researching this operation since then. Kaspersky rate The Mask higher than Duqu in terms of its sophistication and it is possible that the operation was state sponsored.
The main targets of The Mask fall into the following categories:
In the top five infected countries were the United Kingdom, Spain and France with Morocco being the most target country with over 380 IP addresses found in Mask related traffic.
Once a machine is infected, Mask intercepts all the communication channels and start stealing data including encryption keys, VPN configurations, SSH keys and RDP files. It is also possible that it steals data related to custom military/government-level encryption tools.
“Detection is extremely difficult because of its stealth rootkit capabilities. In addition to built-in functionalities, the operators of Careto can upload additional modules which can perform any malicious task. Given the nature of the known victims, the impact is potentially very high,” wrote members of the Global Research & Analysis Team (GReAT) at Kaspersky Lab.
Among the exploits used by The Mask is an Adobe Flash Player vulnerability which was discovered by VUPEN and used to win the CanSecWest Pwn2Own contest in 2012. The exploit, which included a tactic for escaping Google Chrome’s sandbox, was sold to VUPEN’s customers and not disclosed publically. It is possible that the group behind The Mask purchased the exploit from VUPEN.
At the moment the command and control servers used by The Mask are offline. The attackers began taking them offline in January 2014 but it is possible that the attackers could resurrect the campaign at some point in the future. The high degree of professionalism on the part of those running The Mask, including the way it was shutdown and the use of wipe instead of delete for log files, is another reason to believe that the operating was state sponsored.