Unattributed — assessed a highly capable Spanish-speaking nation-state actor (medium confidence on capability; MENA nexus is thin/Morocco-focused; no MITRE Group ID)
Origin
Unknown
First seen
2007
Last active
2014
Motivation
Espionage
Attribution confidence
medium
MENA targeting
Morocco (primary MENA hook), global
Sectors
Government, energy, research, activists
Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Morocco (primary MENA hook), global (Government, energy, research sectors).
What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.
Rows marked inferred are OSINT-extracted enrichment for actors without a MITRE Group ID — treat as analyst assessment, not authoritative ATT&CK attribution.
spearphishing emails with links to exploit sites (Kaspersky)
Regional co-occurrence · associated techniques
Honesty note
Regional co-occurrence is association, not prediction. These techniques appeared alongside Careto / Mask's activity across the tracked MENA roster — a TIE-style association computed on our corpus (not CTID's model), not a prediction of the next move. Ranked by support-adjusted lift (over-representation among actors like this one vs. the roster base rate, damped when few actors back it), so neither a merely-common technique nor a tiny-sample coincidence floats to the top. A hunting lead only; never recorded as observed. ICS techniques are excluded.
Which Microsoft 365 controls protect, detect, or respond to this actor's techniques — from the CTID Mappings Explorer (technique-level). Strength: significant / partial / minimal.
Advanced Anti-Phishing T1566partialAdvanced Anti-Phishing T1566.002partialAutomated Investigation and ResponseT1189significantAutomated Investigation and ResponseT1566significantAutomated Investigation and ResponseT1566.002significantIncident ResponseT1552minimalIncident ResponseT1566minimalQuarantine PoliciesT1566significantQuarantine PoliciesT1566.002significantSafe AttachmentsT1566significantATT&CK Simulation TrainingT1189partialATT&CK Simulation TrainingT1566partialATT&CK Simulation TrainingT1566.002partial
Countermeasures · D3FEND
Defensive techniques that counter Careto / Mask's TTPs, from MITRE D3FEND. The ATT&CK↔D3FEND link is mitigation-mediated — treat these as candidate countermeasures, not prescriptions.