Unveiling the mask V1.0

Unveiling the mask V1.0, pdf write-up, and analysis by Kaspersky Labs.

Excerpt from the writeup:

The Mask is an advanced threat actor that has been involved in cyber-espionage operations since at least 2007. The name “Mask” comes from the Spanish slang word “Careto” (“Ugly Face” or “Mask”) which the authors included in some of the malware modules.

More than 380 unique victims in 31 countries have been observed to date. What makes “The Mask” special is the complexity of the toolset used by the attackers. This includes an extremely sophisticated malware, a rootkit, a bootkit, 32- and 64-bit Windows versions, Mac OS X and Linux versions, and possibly versions for Android and iPad/iPhone (Apple iOS).

The Mask also uses a customized attack against older versions of Kaspersky Lab products to hide in the system, putting them above Duqu in terms of sophistication and making it one of the most advanced threats at the moment. This and several other factors make us believe this could be a nation-state-sponsored campaign. When active in a victim system, The Mask can intercept network traffic, keystrokes, Skype conversations, and PGP keys, analyze WiFi traffic, fetch all information from Nokia devices, screen captures, and monitor all file operations.

The malware collects a large list of documents from the infected system, including encryption keys, VPN configurations, SSH keys, and RDP files. There are also several extensions being monitored that we have not been able to identify and could be related to custom military/government-level encryption tools. Based on artifacts found in the code, the authors of the Mask appear to be speaking the Spanish language.

Download paper