The cybercriminals' actions affected 380 organizations in 31 countries, Kaspersky Lab reported. The largest number of victims were in Morocco, Brazil, and the UK, but the network could also pose a potential threat to Russia, says Vitaly Kamlyuk, a leading antivirus expert at Kaspersky Lab. "The Mask" has been attacking the computer networks of government agencies and corporations since at least 2007. Responsibility for these actions may lie with a large private or government organization, Kamlyuk concludes, and the labor costs of carrying out the attacks amount to millions of dollars, which is a lot for ordinary cybercriminals. He found it difficult to estimate the damage inflicted on the victims.

The high level of support for the cybernet is evidenced by the fact that as soon as Kaspersky Lab reported that it had discovered a certain criminal network (without details), the attackers closed all servers and shut down the operation within four hours. In other cases, it took a day or two.

The network attacked, among other things, the platforms considered reliable: Mac OS X, Linux, and possibly iOS. A person would receive a letter with a link, follow it, the PC would become infected - and the attackers would gain access to documents, logins and passwords, settings, and files for remote control of the system.

In a well-prepared attack, such letters are usually personalized, says Sergey Komarov, head of the antivirus development and research department at Doctor Web. An example is the story of the global Stuxnet virus, when employees of an enterprise received a Word document by mail, allegedly from business partners. And Sergey Nikitin, deputy head of the Group-IB computer forensics laboratory, notes a "sophisticated method" of infecting computers: links to malicious sites were not available from search engines, and a random person could not follow them.

Kaspersky Lab uncovered a cyber spy network of comparable scale, monitoring diplomatic, government and scientific organizations in various countries, in 2013. The attackers (Chinese at that time) targeted mainly the CIS and Eastern European countries, including Russia. From November 2, 2012 to January 10, 2013 alone, more than 55,000 connections were recorded from 250 infected IP addresses in 39 countries.

Kaspersky exposed the spy