The-Mask-has-been-unmasked-again.pdf

The Virus Bulletin paper unveils renewed activity by The Mask (Careto) APT from 2019–2024, describing sophisticated, multimodular implants (FakeHMP, Careto2, Goreto), unique persistence mechanisms (MDaemon WorldClient extension, abusing HitmanPro Alert driver, COM hijacking), and extensive espionage capabilities including keylogging, microphone recording, screenshots and cloud-based exfiltration (OneDrive/Google Drive/Dropbox). The report provides technical details, IOCs (file names, registry keys, a SHA256 hash), observed spreading methods (scheduled tasks, DLL sideloading), and links these recent campaigns to historical Careto operations with medium-to-high confidence.