Mysterious Hacker Group Careto Was Run by the Spanish Government, Researchers Say

Hello followers! Today, let’s dive into a fascinating story about one of the most advanced hacking groups out there: Careto, also known as The Mask.

Over a decade ago, cybersecurity experts at Kaspersky discovered suspicious activity linked to a sophisticated hacking operation. Initially thought to target specific government groups, it soon became clear that Careto was a highly advanced threat capable of stealing sensitive data from governments and private companies worldwide.

What’s really intriguing is that Kaspersky’s research pointed towards Spain’s involvement. Internal findings suggested that the Spanish government might have been behind the operation, although official attribution remained undisclosed. The malware used by Careto was capable of intercepting communications, stealing files, and even spying on device microphones and cameras. They relied heavily on spear-phishing emails, disguising malicious links as Spanish media outlets.

The malware, named after a slang word for “mask,” was used to hack institutions in countries including Cuba, Brazil, Morocco, and the UK. Interestingly, Cuba’s high number of victims might be linked to its historical connections with ETA terrorists and Spanish interests in the region, highlighting how geopolitical motives intertwine with cyber espionage. The malware could operate across Windows, Mac, Linux, and possibly even Android and iPhone devices, making it a truly versatile spy tool.

However, the group was highly disciplined, shutting down operations and destroying logs once exposed, demonstrating a professional and elite level of cyber-espionage. Decades later, Careto resurfaced, targeting new organizations in Latin America and Central Africa, with researchers believing it is still run by a nation-state—most likely Spain—though definitive proof remains elusive.