apt

Careto / Mask

Attribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

The MaskCaretoUgly Face

Attribution

Unattributed — assessed a highly capable Spanish-speaking nation-state actor (medium confidence on capability; MENA nexus is thin/Morocco-focused; no MITRE Group ID)

Origin

Unknown

First seen

2007

Last active

2014

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Morocco (primary MENA hook), global

Sectors

Government, energy, research, activists

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Morocco (primary MENA hook), global (Government, energy, research sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Flying KittenactorTechnique overlap
Rocket KittenactorTechnique overlap
Duqu (Duqu 2.0)actorTechnique overlap
Flame / FlameractorTechnique overlap
BahamutactorTechnique overlap
APT33actorTechnique overlap
Arid Viper (APT-C-23 / Desert Falcon)actorTechnique overlap
APT39 / ChaferactorTechnique overlap
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Careto / Mask's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

4 / 8

Mean robustness (of covered)

2.5

Useful?