MalwareUsed by 1 actor

Careto2

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Careto

That earlier attack involved the use of two malicious frameworks which we dubbed “Careto2” and “Goreto”.

via securelistsecurelist.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

To spread to other machines, attackers uploaded these four files and then created scheduled tasks with the help of the Tpm-HASCertRetr.xml description file.

T1059.003Windows Command ShellEvidence1

When started, these scheduled tasks executed commands specified in the ~dfae01202c5f0dba42.cmd file

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

To spread to other machines, attackers uploaded these four files and then created scheduled tasks with the help of the Tpm-HASCertRetr.xml description file.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

To spread to other machines, attackers uploaded these four files and then created scheduled tasks with the help of the Tpm-HASCertRetr.xml description file.

Collection

2 techniques

T1005Data from Local SystemEvidence1

Its capabilities included retrieving files from the filesystem... Apart from this implant, we also observed attackers deploying... a file stealer to compromised computers.

T1113Screen CaptureEvidence1

Its capabilities included retrieving files from the filesystem, logging keystrokes, taking screenshots... Goreto implements a keylogger and a screenshot taker.

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence1

Comm.dll Uploads exfiltrated data to an attacker-controlled OneDrive storage... Goreto... periodically connects to a Google Drive storage to retrieve commands... uploadfile Reads a specified file from disk, encrypts it and uploads it to Google Drive.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

securelistNews

May 13, 2021

Careto APT’s recent attacks discovered | Securelist

A malicious framework used in the 2019 intrusion. It is installed via a loader, installer, and registry file, persists through COM hijacking, stores plugins in a virtual file system, and includes modules for configuration management, file monitoring, storage of stolen files, screenshots, and exfiltration to attacker-controlled OneDrive.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.