Careto (Windows)
Aliases: TheMask
- Malware type
- spyware, rat, backdoor
- Family
- Malware family
- Last IoC activity
- 2026-06-10 17:55:05
- Profile updated
- 2026-07-07 12:51:51
Targeted industries: government-and-public-sector energy-and-utilities financial-services
Targeted regions: country_code:es country_code:ma country_code:gb country_code:mx country_code:ca
Context
Careto, also known as TheMask, is a sophisticated malware family used for cyber-espionage operations primarily targeting government institutions, energy companies, and financial organizations. It is equipped with advanced tools for data harvesting, including spyware, RAT features, and backdoors, allowing attackers to covertly monitor and exfiltrate sensitive information from compromised systems.
Reports & references
- Kaspersky — 58254 (report)
- techcrunch.com — Mysterious Hacking Group Careto Was Run By The Spanish Government Sources Say (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Careto (report)
- Kaspersky — 114942 (report)
- virusbulletin.com — The Mask Has Been Unmasked Again (report)