Careto Hacker Group is Back After 10 Years of Silence with New Attack Tactics

Careto ("The Mask") has resurfaced after a decade, executing sophisticated targeted attacks against high-profile organizations and critical infrastructure; researchers observed the group exploiting MDaemon's WorldClient by loading a malicious extension via WorldClient.ini to persist, then deploying a previously unknown FakeHMP implant that abused the HitmanPro Alert driver (hmpalert.sys) to inject into winlogon.exe and dwm.exe for keystroke logging, screenshots, file theft, lateral movement and sustained access.