Loading threat actor…
Careto, also known as The Mask, is a highly sophisticated cyber-espionage threat actor active since at least 2007. It has been widely assessed as a state-sponsored operation, and multiple reports have linked it with high confidence to a Spanish-speaking team, with former researchers stating they internally assessed it as operated on behalf of the Spanish government. The actor is known for targeting government institutions, embassies, diplomatic entities, energy companies, research institutions, private companies, and activists across a broad international victim set spanning 31 countries. Cuba has been identified as a particularly significant target, and later activity also affected organizations in Latin America and Central Africa. Careto is notable for advanced multi-platform malware and strong operational security. Historical tooling included modular implants for Windows and macOS, with evidence suggesting Linux and possible mobile targeting. The malware platform supported extensive surveillance and collection functions, including keylogging, screenshot capture, theft of files and credentials, interception of communications, collection of browsing histories and session cookies, theft of cryptographic material and VPN configurations, and covert microphone recording. The actor has also searched compromised systems for private keys and certificates. Initial access has relied on spearphishing with politically themed lures and impersonation of Spanish media, as well as exploit-based delivery through malicious websites that redirected victims to benign pages after compromise. Careto has used sophisticated persistence and stealth mechanisms, including malicious webmail extensions on MDaemon WorldClient, COM hijacking, scheduled-task deployment, DLL sideloading, abuse of legitimate drivers to force malicious DLL loading into privileged processes, and process-wide propagation into selected Windows processes. Recent operations used malware families and frameworks referred to as FakeHMP, Careto2, and Goreto, with capabilities for reconnaissance, command execution, file theft, keylogging, screenshot capture, cloud-based exfiltration, and modular post-exploitation. The actor has demonstrated lateral movement inside victim networks and strong defense evasion, including rapid teardown of infrastructure and log wiping after public exposure in 2014. Careto is regarded as one of the most technically advanced espionage actors publicly documented from Europe, distinguished by mature tradecraft, modular tooling, stealthy persistence, and long-term intelligence collection against high-value targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
36 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Government-linked espionage group cited as historical context for Kaspersky’s attribution signaling; not directly tied to Coruna/Triangulation operations in this article.
Long-running, highly sophisticated espionage actor (active since at least 2007) referenced as resurfacing with a multi-platform malware arsenal.
Careto is conducting advanced cyberattacks targeting high-profile organizations and critical infrastructure, with a focus on government agencies, diplomatic entities, and research institutions. The group is known for deploying zero-day exploits and complex implants, and has recently demonstrated new infection and persistence techniques targeting email infrastructure.
Espionage-focused threat actor using highly advanced malware to compromise government institutions, embassies, diplomatic organizations, private companies, energy companies, research institutions, and activists. The group used spear-phishing, device-specific exploits, email-server compromise, stealthy implants, keylogging, screenshot capture, microphone activation, theft of files, cookies, browsing history, PGP keys, VPN configurations, and rapid infrastructure teardown to evade detection.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.