Carbanak

Carbanak, also known as Anunak, is a financially motivated cybercrime group best known for targeted intrusions into banks, payment processors, e-payment systems, and other financial institutions. The group emerged around 2013 and became widely known after large-scale bank-heist operations that compromised internal banking staff and systems rather than end customers. Public reporting has linked the operation to thefts totaling hundreds of millions of dollars to more than one billion dollars across more than 100 financial institutions in over 40 countries. The actor is widely associated with Russian-speaking cybercrime and has also been linked in some reporting to the later Cobalt lineage; after arrests in 2018, the broader Carbanak/Cobalt ecosystem appears to have fragmented into smaller cells. Carbanak specialized in high-value, hands-on intrusions. Initial access commonly relied on spearphishing with weaponized Office documents and other malicious attachments. Once inside a victim environment, operators conducted extensive reconnaissance, captured screenshots and screen video, monitored employee workflows, and moved laterally to systems tied to payment operations, card processing, ATM management, SWIFT, core banking platforms, and point-of-sale environments. The group used living-off-the-land techniques and legitimate administrative tools alongside malware, including remote services for internal spread and tools associated with credential dumping and memory access. The group’s malware ecosystem centered on the Carbanak backdoor, a remote-access trojan related to leaked Carberp code, but reporting also links the actor to additional tooling including first-stage backdoors, modified Meterpreter components, point-of-sale malware, and later Go-based malware such as GOSH. Carbanak malware and associated payloads have been observed performing host profiling, process enumeration, screenshot capture, keylogging, payload download and execution, in-memory loading, service installation, privilege escalation attempts, process injection, and masquerading under legitimate-looking names. Campaigns have also shown abuse of trusted third-party services for command and control, including legitimate cloud and collaboration platforms, to blend malicious traffic with normal activity. Carbanak monetized access through several distinct fraud schemes: fraudulent interbank and e-payment transfers, ATM cash-out operations, manipulation of card-processing or ATM-management systems, theft of payment-card data from point-of-sale systems, and database manipulation to inflate account balances before withdrawing the fabricated funds. The actor targeted banks directly, but also hit adjacent financial and payment infrastructure, casinos, hotels, restaurants, and retail environments where payment systems could be monetized. Known aliases include Anunak and Carbanak Group. Some reporting and vendor tracking have conflated Carbanak with related clusters such as Cobalt or later successor groups, while other reporting treats them as distinct but overlapping actors within the same Russian-speaking financial cybercrime ecosystem. High-confidence characterization supports Carbanak primarily as a financially motivated threat actor focused on targeted theft from financial institutions and payment systems.