During the first week of October, Kaspersky took part in the 34th Virus Bulletin International Conference, one of the longest-running cybersecurity events. There, Kaspersky researchers delivered multiple presentations, and one of our talks focused on newly observed activities by the Careto threat actor, which is also known as “The Mask”.
The Mask APT is a legendary threat actor that has been performing highly sophisticated attacks since at least 2007. Their targets are usually high-profile organizations, such as governments, diplomatic entities and research institutions. To infect them, The Mask uses complex implants, often delivered through zero-day exploits. The last time Kaspersky published their findings about The Mask was in early 2014, and since then, they have been unable to discover any further traces of this actor.
Read more…
Source: Kaspersky
Related:
- Google patches two Chrome zero-days under active attack
March 13, 2026
Update March 16, 2026 Earlier this week, Google incorrectly reported that an actively exploited vulnerability in Chrome had been fixed, and has now announced it will roll out a new update to protect users against the vulnerability tracked as CVE-2026-3909. Original content: Google has released an out-of-band security update for Chrome desktop that patches two high‑severity ...
- Swedish government IT system hacked
March 13, 2026
A large amount of sensitive information allegedly coming from a Swedish government IT system has been posted on the darknet, according to Dagens Nyheter and Expressen. DN writes that the newspaper has taken note of the leak and that it appears to contain the source code for a digital identity management system used by several authorities. ...
- Poland investigates Iran links behind cyberattack on nuclear facility
March 12, 2026
Poland is looking into whether an attempted cyberattack on a nuclear research facility was carried out by Iran, the government said on Thursday. The country’s digital minister Krzysztof Gawkowski said in an emailed statement that Poland had “identified an attempted cyberattack on the servers of the National Centre for Nuclear Research,” which authorities had thwarted. He ...
- Telus probes cybersecurity incident that ‘ShinyHunters’ group claims responsibility for
March 12, 2026
Canadian telecommunications and business services firm Telus is investigating a cybersecurity incident involving unauthorized access to some of its systems, a company spokesperson said on Thursday. The ShinyHunters hacking group told Reuters in a message it stole at least 700 terabytes of data from Telus. All business operations within the company “remain fully operational, and there ...
- CISA warns max-severity n8n bug is being exploited in the wild
March 12, 2026
The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that hackers are exploiting a max-severity remote code execution (RCE) vulnerability in workflow automation platform n8n. CISA urged all federal civilian executive branch (FCEB) agencies to patch CVE-2025-68613 at once because it carries a near-perfect 9.9 vulnerability score. The bug was first disclosed in December, and ...
- Iran-linked hackers launch cyberattack against U.S. medtech company Stryker
March 11, 2026
U.S. medical technology company Stryker is currently experiencing a massive cyberattack, which has shut down their computer systems and, as a result, even closed the company’s offices. An Iran-linked digital activist collective known as Handala is claiming credit for the cyberattack against Stryker. This would be the first major cyberattack carried out in the wake of the ...