Is this the most advanced malware ever?

[Tony Cole]

Content source

http://www.bleepingcomputer.com/forums/t/578105/is-this-the-most-advanced-malware-ever/

I found this on Bleeping Computer:

HOLY CRAP...HERE'S THE BIG ONE!!!!

this malware has been around a couple of months but has a massive target list... it targets governments, military bases and the gas company that you always go to down the road. It's called "the mask" or "careto" as some people call it

As kaspersky lab has said " What makes The Mask special is the complexity of the toolset used by the attackers. This includes an extremely sophisticated malware, a rootkit, a bootkit, Mac OS X and Linux versions and possibly versions for Android and iOS (iPad/iPhone). The primary targets are government institutions, diplomatic offices and embassies, energy, oil and gas companies, research organizations and activists. Victims of this targeted attack have been found in 31 countries around the world – from the Middle East and Europe to Africa and the Americas."

Now you have to admit it is BADASS and the author is still unknown...They think the author is native to spanish language and that's all they know about the author, Kaspersky labs analysis report "The Mask campaign relies on spear-phishing e-mails with links to a malicious website. The malicious website contains a number of exploits designed to infect the visitor, depending on system configuration. Upon successful infection, the malicious website redirects the user to the benign website referenced in the e-mail, which can be a YouTube movie or a news portal."

More can be found here.

http://www.kaspersky.com/about/news...mplexity-of-the-Toolset-Used-by-the-Attackers

and here

http://www.itproportal.com/2014/02/...ost-advanced-malware-threats-ever-discovered/

 

[Deleted member 178]

as always , primary infection vector is the user.

 

[Cats-4_Owners-2]

I found this on Bleeping Computer:

HOLY CRAP...HERE'S THE BIG ONE!!!!

this malware has been around a couple of months but has a massive target list... it targets governments, military bases and the gas company that you always go to down the road. It's called "the mask" or "careto" as some people call it

As kaspersky lab has said " What makes The Mask special is the complexity of the toolset used by the attackers. This includes an extremely sophisticated malware, a rootkit, a bootkit, Mac OS X and Linux versions and possibly versions for Android and iOS (iPad/iPhone). The primary targets are government institutions, diplomatic offices and embassies, energy, oil and gas companies, research organizations and activists. Victims of this targeted attack have been found in 31 countries around the world – from the Middle East and Europe to Africa and the Americas."

Now you have to admit it is BADASS and the author is still unknown...They think the author is native to spanish language and that's all they know about the author, Kaspersky labs analysis report "The Mask campaign relies on spear-phishing e-mails with links to a malicious website. The malicious website contains a number of exploits designed to infect the visitor, depending on system configuration. Upon successful infection, the malicious website redirects the user to the benign website referenced in the e-mail, which can be a YouTube movie or a news portal."

More can be found here.

http://www.kaspersky.com/about/news...mplexity-of-the-Toolset-Used-by-the-Attackers

and here

http://www.itproportal.com/2014/02/...ost-advanced-malware-threats-ever-discovered/

Thanks for the share, Tony!
I read this aloud to my wife as she spread our toast with jelly.

as always , primary infection vector is the user.

O Hyperborean Traveler Umbra, would sandboxie's or Shadow Defender's protections prevent said 'user' from transforming oneself into an 'infection vector'?

 

[PrMi]

Could be.

 

[Deleted member 178]

O Hyperborean Traveler Umbra, would sandboxie's or Shadow Defender's protections prevent said 'user' from transforming oneself into an 'infection vector'?

i guess, yes

 

[Tony Cole]

Well it's a Nation State developed Malware, so I doubt any security measures us mere mortals could deploy would stop it. This world and internet is getting scarier as the days go by. One famous quote comes to mind "The Internet is the first thing that humanity has built that humanity doesn't understand, the largest experiment in anarchy that we have ever had."

 

[Cats-4_Owners-2]

Well it's a Nation State developed Malware, so I doubt any security measures us mere mortals could deploy would stop it. This world and internet is getting scarier as the days go by. One famous quote comes to mind "The Internet is the first thing that humanity has built that humanity doesn't understand, the largest experiment in anarchy that we have ever had."

Agreed.
I am amazed how such beautifully poetic statements can be created to express what people do when unleashed, en mass, brazenly upon any new world; and it's being worded far more eloquently than the harsh fact that we irresponsibly use, & forever alter, every new environment we are ever fortunate enough to discover.

 

[jamescv7]

Usually nasty/advance viruses can be meet depends on its range therefore rootkit/bootkit are always considered dangerous and especially compatible to more than one OS since it reflects already for vulnerabilities.

 

[Deleted member 178]

dont understimate the power of Shadow Defender !!! i counted 3 malwares that bypassed it , while it doesn't have the MBR protection implemented yet.

now if this malware, is able to reach the Bios , SD will be useless like any other AV.

 

[Cats-4_Owners-2]

dont understimate the power of Shadow Defender !!! i counted 3 aware that bypassed it , while it doesn't have the MBR protection implemented yet.

now if this malware, is able to reach the Bios , SD will be useless like any other AV.

eek!

 

[hjlbx]

dont understimate the power of Shadow Defender !!! i counted 3 malwares that bypassed it , while it doesn't have the MBR protection implemented yet.

Which ones\types?

I've searched everywhere - and - can find no absolutely confirmable cases of SD "bypass."

The single case I am referring to is the rootkit remnant found by Kaspersky TDSSKiller (the Polish video from a few years ago).

 

[Deleted member 178]

Which ones\types?

if my memory is good it was an advanced rootkit

I've searched everywhere - and - can find no absolutely confirmable cases of SD "bypass."

it is why SD is my very first security soft i install after a new installation.

 

[hjlbx]

if my memory is good it was an advanced rootkit

it is why SD is my very first security soft i install after a new installation.

1. Shadow Defender
2. AppGuard

 

[Deleted member 178]

1. Shadow Defender
2. AppGuard

exactly , the rest of my setup is just to give me some fun

 

[WinXPert]

The primary targets are government institutions, diplomatic offices and embassies, energy, oil and gas companies, research organizations and activists

so this means normal users are safe?

 

[Deleted member 178]

so this means normal users are safe?

no, you will just become part of a botnet