Careto (OS X)
Aliases: Appetite, Mask
- First seen
- 2014-01-01 00:00:00
- Malware type
- spyware, rat
- Family
- Malware family
- Profile updated
- 2026-07-07 14:35:30
Targeted industries: government-and-public-sector energy-and-utilities financial-services
Targeted regions: country_code:es country_code:ma country_code:gb country_code:fr
Context
Careto, also known as the Mask and Appetite, is an advanced spyware known to target high-profile victims including government institutions, energy companies, and financial services. It is capable of operations across various platforms, including OS X, and is often associated with nation-state-sponsored attacks.
Detection coverage
- 2 YARA rules
Detection rules
- SIGNATURE_BASE_HKTL_Cobaltstrike_Sleepmask_Jul22 (yara-rule)
- SIGNATURE_BASE_Cobaltstrike_Sleep_Decoder_Indicator (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Osx.Careto (report)
- techcrunch.com — Mysterious Hacking Group Careto Was Run By The Spanish Government Sources Say (report)
- alienvault.com — Os X Malware Samples Analyzed (report)