Loading threat actor…
Carbanak, also known as Anunak and Carbanak Group, is a financially motivated cybercriminal group active since at least 2013, with origins linked to Russia and Ukraine. It specializes in targeted intrusions into banks, financial institutions, and payment-processing environments, as well as point-of-sale systems in hotels, restaurants, and casinos. Its operations have targeted organizations in Russia, Ukraine, the United States, Germany, the United Arab Emirates, Armenia, and Kazakhstan. The group compromises selected high-value victims and moves laterally toward systems that can be monetized through fraudulent transactions, ATM cash-outs, or payment-card theft. Carbanak targets core banking systems, SWIFT infrastructure, ATMs, payment gateways, and point-of-sale terminals. Operators have abused legitimate banking employee credentials to execute fraudulent operations transferring millions of dollars. Its intrusion methods include spearphishing, weaponized Office and RTF documents, embedded script payloads, and exploitation of vulnerabilities such as CVE-2015-1770. Post-compromise activity includes credential theft using Mimikatz, remote execution with PsExec, host and process enumeration, screenshot capture, and deployment of additional backdoors. Its malware establishes persistence through Windows services and obtains SYSTEM privileges, including through exploitation of CVE-2015-2426. The group's toolkit includes the Carbanak backdoor, Carberp, Agent.ORM, Wemosis, modified Tiny Meterpreter, and the Go-based GOSH remote access trojan. Wemosis scrapes payment-card data from point-of-sale process memory, while modified Tiny Meterpreter supports process injection. Carbanak has also used the Kamino OpenSSH backdoor in attacks against Russian banks. Defense-evasion techniques include disguising malware as legitimate Windows components, digitally signing malicious binaries, and loading payloads directly into memory. In its Digital Plagiarist campaign, the group abused Google Apps Script, Google Sheets, and Google Forms for command-and-control, blending malicious communications with legitimate web-service traffic. Carbanak is distinct from FIN7; use of the Carbanak malware family alone does not establish attribution to the Carbanak group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
56 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
25 malware families attributed to this actor across reporting.
20 additional families tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
In other cases attackers used RTF files with different exploits, including an exploit for one of the latest Microsoft Office vulnerabilities, CVE-2015-1770, which was patched by Microsoft in June 2015 in MS15-059.
The trojan attempts to exploit a vulnerability – CVE-2015-2426 in the OpenType manager module (ATMFD.dll) – which was patched by Microsoft in MS15-078. The exploit for this vulnerability was leaked in a Hacking Team dump.
124 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in the detection annotation for a Linux usermod root UID set analytic; no specific campaign or activity is described in this reference.
Financially motivated bank-heist operations against banks, e-payment systems, and other financial institutions using spearphishing, long dwell time, insider-like reconnaissance, ATM jackpotting, fraudulent transfers, and database balance manipulation.
Listed as an associated threat actor for exploitation activity related to abuse of the Windows Cloud Files API / cldapi.dll detection.
Listed as a threat actor associated with exploitation and privilege-escalation detection coverage for Windows admin password changes by non-admin users.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.