{"id":301,"date":"2014-02-14T04:24:44","date_gmt":"2014-02-14T04:24:44","guid":{"rendered":"http:\/\/www.ccrepairservices.com\/blog\/?p=301"},"modified":"2014-02-14T04:30:46","modified_gmt":"2014-02-14T04:30:46","slug":"the-mask-a-malware-campaign-that-remained-undetected-for-7-years","status":"publish","type":"post","link":"https:\/\/www.ccrepairservices.com\/blog\/computer-news\/the-mask-a-malware-campaign-that-remained-undetected-for-7-years\/","title":{"rendered":"The Mask, A malware campaign that remained undetected for 7 years"},"content":{"rendered":"
A Sophisticated cyber spying operation, \u2018The Mask<\/b>\u2019, that has been under the mask for about 7 years targeting approximately 31 countries, has now been \u2018unmasked\u2019 by researchers at Kaspersky Labs<\/i>.\n<\/div>\n
\n<\/div>\n
\n<\/div>\n
The Researchers believe that the program has been operational since 2007 and is seems to be sophisticated nation-state spying tool that targeted government agencies and diplomatic offices and embassies before it was disclosed last month.\n<\/div>\n
\n<\/div>\n
\n<\/div>\n
In the unveiling document published by Kaspersky<\/i>, they\u00a0found more than 380 unique victims, including Government institutions, diplomatic offices\/embassies, private companies, research institutions, activists etc.\n<\/div>\n
\n<\/div>\n
\n<\/div>\n
The name “Mask<\/i>” comes from the Spanish slang word “Careto” (“Ugly Face<\/i>” or \u201cMask<\/i>\u201d) which the authors included in some of the malware modules.\n<\/div>\n
\n<\/div>\n
\n<\/div>\n
Developers of the \u2018Mask<\/i>\u2019 aka \u2018Careto<\/i>\u2019 used complex tool-set which includes highly developed malware, bootkit, rootkit etc. that has the ability to sniff encryption keys, VPN configuration, SSH keys and RDP file via intercept network traffic, keystrokes, Skype conversation, PGP keys, WI-Fi traffic, screen capturing, monitoring all file operations, that makes it unique and dangerous and more sophisticated than DUQU malware.\n<\/div>\n
\n<\/div>\n
\n
The malware targets files having an extension:\n<\/div>\n
\n

*.AKF, *.ASC, *.AXX, *.CFD, *.CFE, *.CRT, *.DOC, *.DOCX, *.EML, *.ENC, *.GMG, *.GPG, *.HSE, *.KEY, *.M15, *.M2F, *.M2O, *.M2R, *.MLS, *.OCFS, *.OCU, *.ODS, *.ODT, *.OVPN, *.P7C, *.P7M, *.P7Z, *.PAB, *.PDF, *.PGP, *.PKR, *.PPK, *.PSW, *.PXL, *.RDP, *.RTF, *.SDC, *.SDW, *.SKR, *.SSH, *.SXC, *.SXW, *.VSD, *.WAB, *.WPD, *.WPS, *.WRD, *.XLS, *.XLSX.<\/p><\/blockquote>\n

\n<\/div>\n
Victims of this malware found in: Algeria, Argentina, Belgium, Bolivia, Brazil, China, Colombia, Costa Rica, Cuba, Egypt, France, Germany, Gibraltar, Guatemala, Iran, Iraq, Libya, Malaysia, Mexico, Morocco, Norway, Pakistan, Poland, South Africa, Spain, Switzerland, Tunisia, Turkey, United Kingdom, United States and Venezuela.<\/i>\n<\/div>\n
\n<\/div>\n
\n<\/div>\n
The malware remains untraceable for about 7 years and was able to infect Mac OS X version, Linux, Windows, iPad\/iPhone and android running devices.\n<\/div>\n
\n<\/div>\n
\n<\/div>\n
According to the researchers, the Mask Malware was designed to infect the 32- and 64-bit Windows versions, Mac OS X and Linux versions, but researchers believe that possibly there may be more versions for Android and iPhones (Apple iOS) platforms.\n<\/div>\n
\n<\/div>\n
\n<\/div>\n
In its main binary a CAB file having\u00a0shlink32<\/i>\u00a0and\u00a0shlink64 dll\u00a0<\/i>files are found during the research from which the malware extract one of them, depending upon the architecture of the victim\u2019s machine and install it as objframe.dll.\n<\/div>\n
\n<\/div>\n
\n<\/div>\n
It includes the most sophisticated backdoor SGH, which is designed to perform a large surveillance function and except this it has DINNER module which gets executed via APC remote calls and reload \u2018chef\u2019 module responsible for network connectivity and \u2018waiter\u2019 modules responsible for all logical operations.\n<\/div>\n
\n<\/div>\n
\n<\/div>\n
Another backdoor called SBD (Shadowinteger’s Backdoor) which uses open source tools like netcat is included in the malware. To infect Linux versions, Mozilla Firefox plugin \u201caf_l_addon.xpi\u201d was used and was hosted on \u201clinkconf[dot]net\u201d\n<\/div>\n
\n<\/div>\n
\n<\/div>\n
Spear phishing<\/i><\/span>, a favorite attack used by most cyber attackers like SEA, was used to distribute this malware. Users were lured to click some malicious websites that contain a number of exploits to compromise their systems.\n<\/div>\n
\n<\/div>\n
Latest Computer news and virus and malware threats at Complete computer Repair Services<\/span><\/strong>\n<\/div>\n

www.ccrepairservices.com<\/a><\/span><\/h2>\n
\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

A Sophisticated cyber spying operation, \u2018The Mask\u2019, that has been under the mask for about 7 years targeting approximately 31 countries, has now been \u2018unmasked\u2019 by researchers at Kaspersky Labs. The Researchers believe that the program has been operational since 2007 and is seems to be sophisticated nation-state spying tool that targeted government agencies and diplomatic offices and embassies before it was disclosed last month. In the unveiling document published by Kaspersky, they\u00a0found more than 380 unique victims, including Government institutions, diplomatic offices\/embassies, private companies, research institutions, activists etc. The name “Mask” comes from the Spanish slang word “Careto” (“Ugly Face” or \u201cMask\u201d) which the authors included in some of the malware modules. Developers of the \u2018Mask\u2019 aka \u2018Careto\u2019 used complex tool-set which includes highly developed malware, bootkit, rootkit etc. that has the ability to sniff encryption keys, VPN configuration, SSH keys and RDP file via intercept network traffic, keystrokes, Skype conversation, PGP keys, WI-Fi traffic, screen capturing, monitoring all file operations, that makes it unique and dangerous and more sophisticated than DUQU malware. The malware targets files having an extension: *.AKF, *.ASC, *.AXX, *.CFD, *.CFE, *.CRT, *.DOC, *.DOCX, *.EML, *.ENC, *.GMG, *.GPG, *.HSE, *.KEY, *.M15, *.M2F, *.M2O, *.M2R, *.MLS, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[19,347,156,452,453,10,25,451,152,180,454,148],"class_list":["post-301","post","type-post","status-publish","format-standard","hentry","category-computer-news","tag-computer-repair","tag-laptop-repairs","tag-malware","tag-malware-news","tag-new-malware","tag-new-virus","tag-online-computer-repair","tag-online-news","tag-spyware","tag-virus-news","tag-virus-removal-service","tag-viruses"],"_links":{"self":[{"href":"https:\/\/www.ccrepairservices.com\/blog\/wp-json\/wp\/v2\/posts\/301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ccrepairservices.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ccrepairservices.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ccrepairservices.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ccrepairservices.com\/blog\/wp-json\/wp\/v2\/comments?post=301"}],"version-history":[{"count":5,"href":"https:\/\/www.ccrepairservices.com\/blog\/wp-json\/wp\/v2\/posts\/301\/revisions"}],"predecessor-version":[{"id":306,"href":"https:\/\/www.ccrepairservices.com\/blog\/wp-json\/wp\/v2\/posts\/301\/revisions\/306"}],"wp:attachment":[{"href":"https:\/\/www.ccrepairservices.com\/blog\/wp-json\/wp\/v2\/media?parent=301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ccrepairservices.com\/blog\/wp-json\/wp\/v2\/categories?post=301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ccrepairservices.com\/blog\/wp-json\/wp\/v2\/tags?post=301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}