Loading threat actor…
Carbanak, also known as Anunak, is a financially motivated cybercriminal group with origins in Russia and Ukraine, active since at least 2013. It conducts targeted intrusions against banks, financial-service providers, payment processors, and hospitality businesses. Its objectives include fraudulent financial transfers, ATM cash-outs, and theft of payment-card data from point-of-sale systems. Its targets have included organizations in Russia, Ukraine, the United States, Germany, the United Arab Emirates, and Armenia. The group compromises selected high-value victims and moves laterally toward systems that can be monetized, including core banking platforms, SWIFT environments, payment gateways, ATM management systems, and point-of-sale servers. It abuses legitimate banking employees' credentials to execute fraudulent transactions. Initial-access methods include spearphishing with weaponized Office documents, embedded script payloads, and exploitation of vulnerable applications. Documented operations have exploited CVE-2015-1770 and CVE-2017-5638, while deployed malware has exploited CVE-2015-2426 for privilege escalation. Carbanak combines custom malware with publicly available tools, including Mimikatz, PsExec, and modified Tiny Meterpreter. Its arsenal includes the Carbanak backdoor, Agent.ORM, Wemosis point-of-sale memory-scraping malware, and the Go-based GOTROJ backdoor. Its implants support host reconnaissance, process enumeration, screenshot capture, remote control, and additional payload execution. Persistence includes Windows services, sometimes running with SYSTEM privileges. Defense-evasion techniques include process injection, digitally signed malware, masquerading as Windows components, and abusing Google Apps Script, Google Sheets, and Google Forms for command-and-control traffic. Carbanak should not be conflated with FIN7 merely because both groups have used the Carbanak malware family.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
56 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
27 malware families attributed to this actor across reporting.
22 additional families tracked in Mallory.
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
In other cases attackers used RTF files with different exploits, including an exploit for one of the latest Microsoft Office vulnerabilities, CVE-2015-1770, which was patched by Microsoft in June 2015 in MS15-059.
The trojan attempts to exploit a vulnerability – CVE-2015-2426 in the OpenType manager module (ATMFD.dll) – which was patched by Microsoft in MS15-078. The exploit for this vulnerability was leaked in a Hacking Team dump.
The December 2017 entry, "The Shadows of Ghosts: Inside the response of a unique Carbanak intrusion," lists GOTROJ malware and states: "Attack involved exploitation of CVE-2017-5638."
128 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in the detection annotation for a Linux usermod root UID set analytic; no specific campaign or activity is described in this reference.
Financially motivated bank-heist operations against banks, e-payment systems, and other financial institutions using spearphishing, long dwell time, insider-like reconnaissance, ATM jackpotting, fraudulent transfers, and database balance manipulation.
Listed as an associated threat actor for exploitation activity related to abuse of the Windows Cloud Files API / cldapi.dll detection.
Listed as a threat actor associated with exploitation and privilege-escalation detection coverage for Windows admin password changes by non-admin users.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.