News and Analysis

The cyber espionage actor known as The Mask or Careto has been linked to attacks on a Latin American organisation in 2019 and 2022. Using spear-phishing emails, malicious websites and a comprehensive malware arsenal, including Windows, macOS, Android, and iOS, the actor typically targets high-profile entities. Kaspersky researchers note that the actor employed an MDaemon webmail component, WorldClient, to infiltrate and persist within the organisation’s system. They also used legitimate HitmanPro Alert software to run malicious commands.