Loading malware…
Carbanak, also known as Anunak and associated in some reporting with Sekur, is a Windows backdoor used in financially motivated intrusions against banks, payment processors, point-of-sale environments, casinos, hotels, restaurants, and other high-value enterprises. It emerged in operations tied to the Carbanak cybercrime group and was later used in adapted form by FIN7 during payment-card theft campaigns. The malware family has been linked to targeted attacks on financial institutions, including compromises involving core banking systems, SWIFT-related environments, ATMs, payment gateways, and point-of-sale infrastructure.
Carbanak functions as a full-featured backdoor with surveillance, command execution, and payload-delivery capabilities. Documented behavior includes enumerating running processes, capturing screenshots, recording desktop video, logging keystrokes for selected processes, downloading and executing additional components, loading binaries in memory, and deleting files on command. It has also been observed installing VNC server software to provide remote interactive access. For persistence, Carbanak stores configuration data in the Windows startup directory so it can automatically execute after reboot.
Its command-and-control communications have used HTTP with layered obfuscation and encryption, including Base64 encoding, RC2 in CBC mode, and XOR with random keys. Variants and related tooling in Carbanak operations have also used trusted third-party services for command and control, including Google Apps Script, Google Sheets, and Google Forms, to blend malicious traffic with legitimate web activity.
Delivery has commonly relied on targeted spearphishing. Observed lures included malicious attachments such as weaponized Office documents, RTF exploit files, and socially engineered embedded script content requiring user interaction. Campaigns have also used mirrored or spoofed infrastructure to host lure documents. In some FIN7 intrusions, victims were contacted by email and then socially engineered into opening attachments, after which an adapted Carbanak implant was used alongside other tooling to steal payment-card data.
Carbanak has also appeared as a payload delivered by other malware components and loaders. Reporting has described first-stage backdoors used to assess victims before deploying Carbanak, as well as later FIN7 loader activity that delivered newer Carbanak variants through DLL hijacking and in-memory execution. Across these operations, Carbanak has remained closely associated with financially motivated post-compromise activity focused on theft, surveillance of operator workflows, and remote control of infected Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
While the code in the different families – Carbanak (Win32/Spy.Sekur), Win32/Spy.Agent.ORM, and Win32/Wemosis – is different it does contain similar traits, including the same digital certificate.
[T1190] CVE-2017-5638 (Apache Struts) Technique Élévation de privilèges sur un système d’exploitation Linux.
While the code in the different families – Carbanak (Win32/Spy.Sekur), Win32/Spy.Agent.ORM, and Win32/Wemosis – is different it does contain similar traits, including the same digital certificate.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Implant JsOutProx have capabilities similar to FIN-7 APT's Carbanak. Carbanak shared the same goals and was designed to perform similar tasks.
Début février 2014, le groupe cybercriminel a commencé à utiliser la porte dérobée Carbanak (alias Sekur). Ce code malveillant est une variante de la porte dérobée Anunak, elle-même variante du cheval de Troie Carbep.
An alleged FIN7 campaign, tracked as UNC4536 and UNC3319 by Mandiant, that distributed NetSupport RAT, possibly followed by DiceLoader or Carbanak.
An alleged FIN7 campaign, tracked as UNC4536 and UNC3319 by Mandiant, that distributed NetSupport RAT, possibly followed by DiceLoader or Carbanak.
Evil Corp aurait, d’après Blueliv, propagé d’autres codes malveillants ... mais aussi Carbanak.
Tools: SpicyOmelette, Cobalt Strike, Meterpreter, Mimikatz, CobtInt, ATMSpitter, Carbanak, Buhtrap, Cyst, Metasploit. CTU researchers assess with moderate confidence that GOLD KINGSWOOD is associated with, and may be a progression of the group referred to as Carbanak...
35 distinct techniques documented for this family, organized by ATT&CK tactic.
Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The lure documents exploited known Office vulnerabilities to run code on the operator’s machine.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
FIN7 emploie plusieurs techniques d’assombrissement... la signature numérique des documents piégés et des codes malveillants utilisés ; l’obfuscation de charge utile... dénommée FINcoding...
...la dissimulation du caractère malveillant des codes sous une apparence légitime... la version 3.7.4 de la porte dérobée Carbanak être référencée comme Check Point Software Technology...
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
Once an attached file was opened and activated, FIN7 would use an adapted version of the Carbanak malware, in addition to an arsenal of other tools, to access and steal payment card data for the business’s customers.
The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.
The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."
Operators recorded video of employees’ screens to learn each bank’s internal procedures.
Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.
Par exemple Bellhop et Carbanak peuvent communiquer via HTTP. / Par exemple Domenus VBS peut communiquer via HTTPS.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.
À l’issue du processus de recrutement, des outils d’intrusion sont fournis au candidat, parmi lesquels... Carbanak et Lizar...
In the United States alone, FIN7 successfully breached the computer networks of businesses in all 50 states and the District of Columbia, stealing more than 20 million customer card records from over 6,500 individual point-of-sale terminals at more than 3,600 separate business locations.
59 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
117 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a possible follow-on payload in a separate FIN7-linked campaign.
Annotations ID Technique Tactic T1078 Valid Accounts Initial Access T1098 Account Manipulation Persistence T1548.001 Setuid and Setgid Privilege Escalation Delivery Installation Exploitation ... Carbanak ...
A banking-focused backdoor/RAT used to infiltrate financial institutions, observe operator workflows, capture keystrokes and screen/video, move laterally, and enable ATM jackpotting, fraudulent transfers, and account-balance manipulation.
A historically significant financial intrusion toolkit/backdoor associated in the content with FIN7/Carbanak Group and major theft from financial institutions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.