Cyber espionage by 'Careto': Spain's government under suspicion

In 2014, the Russian cyber security company Kaspersky made a worrying discovery. A sophisticated hacker group called Caretoalso known as "The Mask", had been carrying out cyber espionage unnoticed for years. The name comes from Spanish slang and means "mask" or "ugly face" - a term that was found in the source code of the malware used.

Particularly explosive: Former Kaspersky employees later revealed that the Spanish Careto Group was probably directly controlled by the government in Madrid. This represents a notable case of a Western country being involved in state-led cyber espionage - an area that until now has mainly been associated with states such as Russia, China or North Korea.

The revelations about the links between the Careto Group Spain and government agencies raise important questions about the global cyber security landscape. How far do Western democracies go with digital surveillance? What were the group's objectives and what techniques did they use? We will examine these questions in more detail below.

Important findings

• The hacker group Careto was discovered by Kaspersky in 2014 and is one of the most advanced cyber espionage actors in the world
• The name "Careto" comes from Spanish slang and means "mask" or "ugly face"
• Former Kaspersky employees have uncovered links to the Spanish government
• The group represents a rare case of Western state hacking activities
• The revelations change the current understanding of the global cyber espionage landscape
• The Group's technical capabilities indicate significant resources and expertise

Introduction to the topic of cyber espionage

The world of cyber espionage is a shadowy realm in which state actors such as the Careto Group of Companies operate covertly. At a time when data has become the most valuable commodity, the methods of gathering information have changed fundamentally. The focus is no longer on physical break-ins or the recruitment of informants, but on digital infiltration and covert surveillance.

The revelations about the allegedly Spanish-controlled Careto Group have shed light on the reality of state-led cyber espionage. This development raises fundamental questions about digital sovereignty and the protection of sensitive information.

What is cyber espionage?

Cyber espionage refers to the targeted and usually covert acquisition of sensitive information by digital means. In contrast to ordinary cybercrime, which is often aimed at quick financial gain, cyber espionage usually pursues Long-term strategic, political or economic goals.

The Careto Group of Companies represents a particularly sophisticated case of state-sponsored cyber espionage. It belongs to the category of advanced persistent threats (APTs) - sophisticated threats that are characterized by three main features:

• Long-term presence in compromised systems
• Highly targeted attacks
• Use of advanced techniques and tools

APTs such as Careto use complex malware, social engineering and zero-day exploits to penetrate networks undetected and remain there for long periods of time. While most known APT groups are attributed to countries such as Russia, China or North Korea, the case of the Careto Holding Spainthat Western democracies are also actively operating in this area.

"Modern cyber espionage is the digital continuation of classic intelligence work with other means. The key difference is that the attackers no longer have to set foot in the target country and can still gain deep insights into its most sensitive areas."

Significance and impact today

In our increasingly networked world, cyber espionage has taken on enormous strategic importance. It enables states to obtain sensitive information without physical presence or open confrontation. The Careto Holding Spain is an example of this development.

The effects of cyber espionage are complex and far-reaching. On a diplomatic level, the discovery of such operations can lead to considerable tensions between states. Economically, the theft of business secrets and technologies can cause billions of dollars in damage.

The increasing blurring of the boundaries between state and non-state actors is particularly worrying. The revelations about Careto have shown that even supposedly transparent democracies carry out secret cyber espionage operations, which Fundamental questions on democratic control of such activities.

For companies and organizations, this means that they must protect themselves against sophisticated attacks carried out with government resources and expertise. This poses an enormous challenge, as attackers often have resources that go far beyond the capabilities of commercial security solutions.

The Careto Group of Companies is considered one of the most advanced APT groups of its time, comparable to other state-sponsored groups such as Flame or the Equation Group, which is believed to be associated with the NSA. Their sophisticated espionage software targeted governments, companies and activists worldwide.

Overview of the Careto Group

Operating in the shadow of the digital world, the Careto Group Spain as a highly professional espionage unit whose true identity only came to light in 2014. This cyber espionage group was one of the most technically advanced of its kind and had a remarkable ability to conceal its activities for years. The discovery of their operations revealed a complex network with suspected links to state actors.

History of the Careto Group

The history of the Careto group of companies The story begins in 2007, when their first digital traces were discovered. For over seven years, the group was able to operate unnoticed and gather information from numerous targets worldwide.

The decisive turning point came in 2014, when security experts from Kaspersky identified suspicious network traffic. Initially, the researchers suspected that an already known state-controlled group was behind the activities. However, upon deeper analysis, they discovered a previously unknown entity.

The name "Careto" comes from a Spanish slang word that the experts found in the malware's program code. The group's reaction to its exposure was particularly remarkable: within a few hours of the Kaspersky report being published, the group withdrew and deleted all traces of its infrastructure.

This behavior underlines the team's high level of professionalism and indicates clearly defined contingency plans - a typical feature of state-supported cyber operations. The quick and coordinated response caught the attention of experts and increased suspicions about possible links to government agencies.

Goals and motivations of the group

In contrast to financially motivated cyber criminals, the Careto Group Spain on strategic information gathering. The group targeted diplomatic institutions, energy companies and research institutes in 31 different countries.

The focus on Cuba was particularly striking, where a government network even served as "patient zero" for the Kaspersky investigation. This focus can be explained by the historical ties between Spain and Cuba, as well as the fact that the island provided refuge to members of the Basque separatist organization ETA - a clear security interest for Spain.

Gibraltar, a territory claimed by Spain and under British control, was also targeted by the group. Other important targets were facilities in Brazil, Algeria, France and Venezuela. This geographical distribution of targets shows clear overlaps with Spain's foreign policy and strategic interests.

The Careto group of companies was clearly pursuing geopolitical goals that coincided with Spain's national interests. Rather than aiming for immediate financial gain, the group systematically collected information that could be of high value to a state's foreign and security policy. This orientation reinforces the presumption of state support or control.

Connections to the Spanish government

The threads of the Careto Corporate Group Spain lead directly to the control centers of the Spanish government, according to security experts. Although there was no official confirmation for a long time, there is growing evidence that this sophisticated cyber espionage operation was directed by the state. The professionalism and strategic orientation of the attacks point to resources that are typically only available to governments.

Possible influence and control

According to reports from TechCrunch, former employees of Kaspersky in 2025 have confirmed that there are internal "no reasonable doubt" in the connection between the Spanish government and Careto. The Spanish secret service CNI (Centro Nacional de Inteligencia) in particular is suspected of being the driving force behind the operations.

Such a cyber operations group is typically controlled via several layers of concealment. Experts assume that the CNI did not act directly, but via middlemen or front companies to ensure plausible deniability.

This revelation places Spain in the small group of Western countries that have demonstrably developed advanced cyber espionage capabilities. The structure of the Spanish Careto company suggests a professional organization equipped with considerable resources.

Evidence and indications of cooperation

The indications of a connection between Careto and the Spanish government are varied and convincing. The following evidence is particularly revealing:

• Spanish language elements in the source code of the malware, including numerous terms and debug statements that indicate developers with Spanish as their native language
• Strategic target selectionwhich reflects Spanish geopolitical interests
• Technical sophisticationwhich indicates considerable resources and expertise
• Professional behavior after the unmasking by Kaspersky

The focus on Cuba, where members of the Basque terrorist organization ETA (Euskadi Ta Askatasuna) found refuge, was particularly striking. This choice of target indicates a strong interest on the part of the Spanish government, which has been fighting ETA for decades.

Gibraltar, a disputed territory under British control that Spain has long claimed, was also the focus of the attacks. These targets clearly reflect Spanish national interests and underpin the link to the government.

The Careto Corporate Group Spain used sophisticated malware that ran on different operating systems and even exploited vulnerabilities in Kaspersky products. This technical complexity indicates resources typically only available to state actors.

After being exposed by Kaspersky, the group retreated at lightning speed and erased all traces - a further indication of a highly professional, state-controlled operation. Kaspersky himself avoided a public attribution to Spain, presumably to avoid diplomatic tensions, but internally the connection was considered to be secure.

Techniques of the Careto Group

With a sophisticated arsenal of malware and surveillance tools, the Careto Business Group as one of the most technically adept cyberattack groups of its time. Categorized as an "elite APT" by security experts, the group possessed capabilities that impressed even experienced cybersecurity analysts. Their technical methods and tools demonstrated a level of complexity typically only achievable with government support.

Malware and tools used

The centerpiece of the Careto operations was a Highly modular malwarewhich became known for its adaptability. This malware could run on various operating systems - including Windows, Linux and macOS - a rarity for APT groups of this era. Security experts even found evidence of versions for mobile platforms such as iOS and Android.

The malware of the Careto Business Group was characterized by its modular structure. Different components could be activated depending on the target and requirements. This flexibility enabled attackers to target their attacks precisely on specific information without leaving unnecessary digital traces.

The ability of the malware was particularly worrying, extract cryptographic keys. This indicates a deep technical understanding and significant resources. The group also used zero-day exploits - previously unknown vulnerabilities - to penetrate systems, including vulnerabilities in Kaspersky's own antivirus software.

The technical capabilities of the malware included:

• Recording of keystrokes
• Interception of encrypted communication
• Creation of screenshots
• Theft of sensitive files
• Monitoring WLAN data traffic

Focus on digital surveillance

The Careto Business Group pursued a clear strategy of digital surveillance. Unlike financially motivated cyber criminals, the aim was not to make a quick profit, but to gather information covertly over the long term - a typical feature of state-led espionage operations.

The attack process typically began with Spear phishing e-mailswhich were specially tailored to the recipients. These emails pretended to come from Spanish newspapers and contained links to deceptively genuine-looking websites. As soon as the victims clicked on these links, the malware was installed in the background.

The monitoring capabilities of the Careto Business Group were extensive. The malware used could not only steal documents, but also monitor ongoing communications, intercept passwords and even compromise encrypted connections. Particularly noteworthy was the ability to analyze network traffic and extract sensitive data.

"The technical sophistication of the Careto malware is comparable to the most advanced state-sponsored hacking groups we have ever observed."

The group operated with extreme caution and precision. Their attacks were designed in such a way that they could remain undetected for long periods of time. This enabled continuous monitoring of the target systems and the extraction of valuable information over months or even years.

The Careto Group's technical capabilities underline the high level of resources and expertise that went into the development of its tools. This combination of technical sophistication and strategic patience makes the group a prime example of modern cyber espionage.

Affected organizations and countries

With attacks on facilities in 31 countries worldwide, the Spanish Careto Group conducted one of the most comprehensive cyber espionage campaigns in recent decades. The targets were strategically selected and included organizations of particular importance to Spanish interests. This far-reaching operation illustrates the technical capabilities and geopolitical ambitions behind the Careto malware.

Who was targeted?

The Careto Group Spain concentrated its attacks on a wide range of strategically important facilities.Government networkswere a particular focus, especially in countries with geopolitical significance for Spain. Cuba proved to be one of the main targets, which can be explained by the historical links between the two nations and the suspected presence of ETA members on the island.

Gibraltar, the British overseas territory claimed by Spain, was also intensively targeted. This underlines the link between cyber espionage and Spain's territorial interests.

Diplomatic missions were another important target category. The attacks on these institutions indicate a strong interest in foreign policy information. Embassies and consulates in Brazil, Algeria, France, the UK and Venezuela were particularly affected.

Research institutes, particularly those focusing on technology and security, were also attacked. The aim was presumably to gain access to valuable research results and intellectual property. These attacks show that the Careto Group was not only interested in political information, but also in scientific and technological information.

Energy companies were another strategic target. The infiltration of these organizations underlines the importance of energy security in the context of modern cyber espionage. Companies in Latin America and North Africa were particularly affected.

It is also noteworthy that activists and civil society organizations were targeted. This indicates that monitoring political opposition movements was also one of the aims of the operation.

International reactions and effects

The revelations about the alleged connection between the Careto Group and the Spanish government have provoked different reactions internationally. In the cyber security community, the realization that Western democracies also deploy sophisticated cyber espionage capabilities caused a stir.

When Kaspersky Lab first discovered the malware in 2014, the company avoided directly attributing it to Spain. This was presumably to avoid diplomatic tensions. It was not until 2025 that former employees confirmed to TechCrunch that the Spanish government was the mastermind.

The muted international diplomatic response to these revelations is remarkable. This indicates that cyber espionage is now considered common practice among states.The tacit acceptance of such activities has created a new normality in international relations.

However, for the countries concerned, particularly Cuba and other Latin American countries, the revelations put a strain on bilateral relations with Spain. In some cases, this led to diplomatic tensions and formal protests.

On a technical level, the findings about the Careto Group led to increased security measures. Many organizations reviewed their networks for signs of compromise and improved their defenses against similar attacks.

The revelation adds Spain to the small group of Western countries that have been proven to engage in advanced cyber espionage. This also includes the USA with the Equation Group, France with Animal Farm and the UK with its own cyber espionage programs.The revelation of Careto's activities has raised awareness of state-directed cyberattacks worldwide. It shows that not only traditional cyber powers such as Russia, China or the USA have advanced cyber espionage capabilities, but also medium-sized states such as Spain.

The long-term impact of these revelations on the international cyber security landscape is not yet fully foreseeable. What is clear, however, is that the Careto Group Spain had a significant impact on the development of state cyber espionage capabilities and their perception in the international community.

Case studies on known attacks

Specific case studies reveal the true scale and sophistication of cyberattacks by the Careto Group, which is believed to be controlled by Spain. The attack patterns of this highly specialized unit differ significantly from ordinary cybercrime and point to a state-led operation. While typical cybercriminals in Spain usually seek financial gain through bank fraud or ransomware, the Careto Group of Companies clearly defined geopolitical goals.

Detailed analysis of specific incidents

One particularly revealing case concerns the attack on a Cuban government network, which later served as "patient zero" for the Kaspersky investigation. The operation began with a deceptively genuine phishing email purporting to come from a Spanish news site. The link it contained led to a fake website that was almost indistinguishable from the original.

When this page was visited, a zero-day exploit was executed in the background that exploited a vulnerability in the browser. The installed malware remained undetected for over two years and collected data during this time:

• Diplomatic correspondence
• Internal strategy papers
• Information about ETA members in Cuba

Another notable case concerned an energy company in Algeria. Here the Careto Holding Spain targeted information on gas supply contracts with European countries. For this attack, the group used a customized Linux variant of its malware, which was developed specifically for the systems frequently used in this sector.

The attacks were carried out using spear phishing - targeted phishing emails that were often disguised as Spanish newspapers. What is remarkable is the technical versatility of the group, which developed customized malware for Windows, Linux, macOS and presumably also mobile operating systems such as iOS and Android.

"The precision and adaptability of these attacks underlines the group's technical expertise and strategic focus. We are not dealing with ordinary cyber criminals here, but with a highly professional operation."

Lessons from the attacks

The Careto Group's operations offer important insights for understanding modern cyber espionage. First of all, the attacks show that the boundaries between "good" and "bad" actors in cyberspace are becoming blurred - even democratic states are apparently using advanced cyber espionage.

A second important lesson concerns the challenge of attribution. While technical clues such as Spanish language elements in the code can provide important clues, clear attribution to state actors often remains difficult and politically sensitive.

Thirdly, the case illustrates the fundamental difference between financially motivated cybercrime and state-directed espionage:

Fourthly, the case shows how important a multi-layered security approach is. Even advanced security solutions such as those from Kaspersky were initially circumvented by Careto. The threat could only be identified through a combination of different detection methods.

The group's reaction after their exposure was particularly impressive: within a few hours they withdrew and erased all traces of their activities. This quick and thorough reaction underlines the Exceptional professionalism of the operation and indicates considerable resources that are typically only available to state actors.

The ability to develop customized malware for different operating systems also shows that the group had a team of highly skilled developers - another indication of a state-sponsored operation.

The role of cyber security

In an ironic twist, Spain, the presumed home of the Careto Grouphas made considerable progress in the area of cyber security. While on the one hand there are suspicions that the government is supporting offensive cyber operations, the country has at the same time significantly expanded its defense capabilities. This duality reflects the complex reality of modern digital security policy.

Current security measures in Spain

In recent years, Spain has developed robust structures to combat cybercrime. The main responsibility lies with two institutions: the Guardia Civil and the Policía Nacional, whereby the specialized Unidad de Investigación Tecnológica is particularly noteworthy.

At a national level, the Instituto Nacional de Ciberseguridad (INCIBE) plays a key role. This organization not only coordinates prevention measures, but also operates a Computer Emergency Response Team (CERT), which monitors cyber incidents and enables coordinated responses.

The establishment of the Mando Conjunto del Ciberespacio (MCCE), which is responsible for the defense of critical infrastructures, is also noteworthy. This military unit underlines the strategic importance that Spain attaches to cyber security.

Spain is also actively involved in international initiatives such as the EU cyber security agency ENISA and the NATO Cooperative Cyber Defense Centre of Excellence. This cooperation demonstrates a commitment to collective security in a networked world.

Importance of prevention and awareness

In the face of sophisticated threats such as the Careto group of companies prevention and awareness are becoming increasingly important. The Careto operations have impressively demonstrated that even advanced technical protection measures can be circumvented by social engineering and targeted phishing attacks.

INCIBE has launched extensive awareness campaigns aimed at both companies and private individuals. These campaigns teach basic security practices such as:

• Detection of phishing attempts
• Importance of regular software updates
• Secure handling of sensitive data
• Implementation of the principle of least privilege

For companies, INCIBE offers specialized training courses that address industry-specific threats. Raising awareness of advanced persistent threats (APTs) such as Careto, which operate in a targeted manner over long periods of time, is particularly important.

The irony is obvious: while Spain may have the Careto Group Spain while at the same time protecting its citizens and companies from similar threats. This tension between offensive capabilities and defensive measures is characteristic of modern cyber security policy in many countries.

"The best defense is not just a good firewall, but an educated user who recognizes threats before they can cause damage."

The development of the Spanish cyber security landscape shows that technical measures alone are not enough. Only the combination of robust security systems, international cooperation and comprehensive education can provide effective protection against threats such as the Careto group of companies.

Legal framework

The legal landscape in which the Careto Corporate Group Spain is characterized by national laws and international agreements with considerable grey areas. These legal structures form a complex web of regulations that are intended to ensure protection against cyber attacks on the one hand, but also leave room for state surveillance activities on the other. The inconsistency between official legislation and alleged covert operations raises fundamental questions about the rule of law in the digital space.

Spanish cybersecurity legislation

Spain has a comprehensive range of legal instruments to combat cybercrime. At the center of this is the Spanish Criminal Code (Código Penal), which criminalizes specific offences against privacy and unauthorized access to computer systems in Articles 197 to 201. These provisions have been continuously tightened in recent years in order to keep pace with technological developments.

Law 11/2002, which regulates the activities of the Spanish intelligence service CNI, exists in parallel. This law grants the secret service far-reaching powers to obtain information in the name of national security. Although these surveillance measures are theoretically subject to judicial control, practical oversight often remains limited and non-transparent.

With the implementation of the EU Network and Information Security (NIS) Directive, Spain updated its cybersecurity law in 2018. This reform led to stricter reporting obligations for security incidents and higher standards for the protection of critical infrastructures. Companies and authorities must now implement more robust security measures and report cyberattacks to the relevant authorities.

The irony in this context is obvious: the same government that introduces and propagates these protective measures is alleged to have authorized offensive cyber operations such as those of the Careto social group Spain. This creates a tension between the declared goal of protecting its own citizens and the alleged implementation of espionage operations against other countries and organizations.

International agreements against cyber espionage

The Spanish Careto company operated not only within the national but also the international legal framework, which does not regulate cyber espionage sufficiently. A central element of this framework is the Budapest Convention on Cybercrime, which Spain ratified in 2010. However, this convention focuses mainly on criminal activities and largely excludes state actors.

This legal loophole creates a gray area in which operations such as those of the Careto Group can take place without having to fear clear legal consequences. At EU level, the Cybersecurity Directive (NIS) has established standards for the protection of critical infrastructure, but does not directly address state espionage or offensive cyber operations.

The UN Group of Governmental Experts (UN GGE) has developed standards for responsible state behavior in cyberspace. However, these are not legally binding and are based on voluntary compliance. The Tallinn Manuals on the Application of International Law to Cyber Operations provide a further framework for orientation, but also have no binding effect.

It is worth noting that Spain actively participates in international efforts to combat cybercrime. One example is Operation Talent 2025, in which Spanish authorities worked with Europol to shut down two major cybercrime forums. This public cooperation is in stark contrast to the alleged covert cyber operations.

However, this double standard is not a phenomenon limited to Spain, but a global one: many states publicly condemn cyberattacks while secretly developing and deploying similar capabilities. The legal ambiguity at international level allows states to carry out offensive cyber operations without having to fear clear legal consequences.

The legal assessment of the activities of the Careto Group Spain therefore remains complex. While the activities lie in a gray area from the perspective of international law, they could either be illegal under Spanish law or covered by special intelligence rights. This ambivalence illustrates the challenges involved in the legal regulation of cyber espionage in an increasingly networked world.

Outlook on the future of cyber espionage

Technological innovations and geopolitical shifts will define the coming years of cyber espionage and create new challenges for groups like Careto. The digital landscape is changing at breathtaking speed, which means that both attack and defense methods are constantly evolving. For state-sponsored actors, this means a constant arms race in cyberspace.

Possible developments for the Careto Group

After her exposure in 2014, the Careto Business Group fundamentally rethink their strategy. Experts suspect that the group initially went completely underground in order to completely overhaul its infrastructure and develop new camouflage methods.

Recent reports indicate that Careto is continuing its operations with changed tactics, but with extreme caution. The geographical focus appears to have shifted to regions with less advanced cyber security capabilities - particularly Latin America and parts of Central Africa.

This relocation is probably a strategic decision to minimize the risk of rediscovery. However, the basic mission probably remains unchanged: the targeted acquisition of strategically valuable information in line with Spanish geopolitical interests.

Technologically, the Careto Business Group increasingly rely on innovative methods:

• Fileless malware that leaves no traces on hard disks
• Advanced obfuscation techniques such as steganography
• Targeted attacks on cloud services and IoT infrastructures
• AI-supported attack methods for automation and data analysis

The modularity and adaptability of Careto malware has already made it a role model for other APT groups. These characteristics will become even more important in the future as security systems become more sophisticated.

The role of technology in change

Technological progress will fundamentally change cyber espionage in the coming years. Artificial intelligence and machine learning are already revolutionizing both attack and defence capabilities.

Attackers like the Careto Group can use AI to perfectly personalize phishing messages, automatically identify vulnerabilities and evade defenses in real time. At the same time, these technologies enable improved detection systems that can immediately identify anomalous behavior.

The increasing spread of quantum computers poses a further challenge. This technology could potentially render existing encryption methods obsolete and jeopardize both the security of sensitive data and create new opportunities for encrypted communication between attackers.

Cloud computing and the fragmentation of IT infrastructures make it much more difficult to secure networks. For groups like Careto, this offers new attack vectors, but also requires them to adapt their tactics.

"The next generation of cyber espionage will no longer be characterized primarily by the exploitation of technical vulnerabilities, but by the ability to identify and exploit human and organizational weaknesses."

The rise of the Internet of Things (IoT) is expanding the attack surface exponentially. Many of these devices are developed with minimal security precautions, making them easy targets. For state actors such as the Spanish authorities allegedly behind Careto, this presents both new opportunities and new challenges.

For the future of cyber espionage, a picture is emerging in which success depends less on individual technical breakthroughs and more on the ability to continuously adapt and skillfully combine different technologies. The Careto Business Group has already proven that she has this ability - a quality that could also ensure her success in the future.

Conclusion and recommendations for action

The revelations surrounding the Careto Group Spain mark a significant turning point in the understanding of state-directed cyber espionage. The technical sophistication and targeted approach of this operation, which was presumably controlled by the Spanish secret service, shows that Western European democracies are also active participants in the global cyber war.

Summary of the most important points

The Spanish Careto Group is a prime example of sophisticated APT attacks. Their choice of targets - particularly Cuba and Gibraltar - clearly reflects Spanish geopolitical interests. The rapid response after exposure and the advanced techniques used indicate significant state resources. The case raises critical questions about the double standards of Western states that condemn cyberattacks while developing offensive capabilities themselves.

Tips for strengthening individual cyber security

In the face of such threats, practical protective measures are essential:

Remain vigilant for emails with links or attachments, even if they appear to come from trustworthy senders. Always keep operating systems and programs up to date, as the Careto Group Spain exploits known vulnerabilities. Activate two-factor authentication for important accounts and encrypt sensitive data.

Make regular backups of your most important data and use VPN services to protect your online activities. Develop a healthy distrust of unusual online interactions, as social engineering remains a major attack vector. Stay informed about current threats through security blogs or warnings from authorities such as the BSI.

The story of the Spanish Careto Group teaches us that the boundaries between friend and foe are becoming increasingly blurred in the digital age - a realization that is of crucial importance for our digital security.