Carbanak
Carbanak is a financially motivated threat actor and associated malware cluster also referred to as Anunak, and is linked in the content to Cobalt Group and to assessments that GOLD KINGSWOOD may be associated with or a progression of Carbanak. The group has targeted banks, including banks in Russia and Ukraine since early 2014, and broader financial institutions, including payment systems. The content notes Carbanak historically targeted payment systems on weekends. Observed tradecraft in the content includes phishing for initial access followed by living-off-the-land activity; use of Rundll32 to execute code embedded in DLLs; abuse of ProcDump to dump LSASS memory; internal spread via RDP and SMB; installation as a Windows service for persistence and SYSTEM privileges; use of scheduled tasks; use of remote access tools and legitimate remote administration software including AmmyyAdmin and TeamViewer for interactive command and control; use of open-source tools such as PsExec and Mimikatz; and use of netsh-related firewall or network configuration modification. The content also states Carbanak named malware svchost.exe to masquerade as the Windows shared service host process. For command and control, the content states Carbanak used a VBScript named ggldr that relied on Google Apps Script, Google Sheets, and Google Forms services. The malware is also described as having a plugin for VNC and the Ammyy Admin tool. The content repeatedly associates Carbanak with ATT&CK techniques including T1543.003 Windows Service, T1219 Remote Access Tools, T1218.011 Rundll32, T1562.004 Disable or Modify System Firewall, and T1053 Scheduled Task/Job.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
46 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
10 malware families attributed to this actor across reporting.
5 additional families tracked in Mallory.
Observables
15 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor for exploitation activity related to abuse of the Windows Cloud Files API / cldapi.dll detection.
Listed in the detection annotations as a threat actor associated with exploitation for privilege escalation and Windows service persistence/installation.
Listed as a threat actor associated with exploitation and privilege-escalation detection coverage for Windows admin password changes by non-admin users.
Referenced as a threat actor associated with abuse of remote management tooling for persistence and command-and-control.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.