Careto__2014__unveilingthemask_v1.0.pdf

Kaspersky Lab presents a detailed analysis of "Careto" (aka The Mask), a highly sophisticated, multi-year APT cyber-espionage campaign that used modular, cross-platform malware (Careto, SGH, SBD), kernel/rootkit and bootkit techniques, signed binaries and exploit-laden spear-phishing to compromise government, diplomatic, energy and private-sector victims in 31 countries; the report includes technical TTPs, C2 infrastructure, exploits, digital certificates and a comprehensive set of indicators of compromise.