{ "family": "carbanak", "sample_count": 2, "category": "banking_trojan", "description": "Carbanak (also cataloged across international law enforcement and intelligence communities as Anunak) is an elite, multi-million dollar cyber heist malware framework first detected in 2013. Developed and deployed by the notorious FIN7 and Carbanak cybercrime syndicates, the malware was engineered for targeted financial espionage, remote bank intranet infiltration, and massive fraudulent asset liquidation.\n\nUnlike conventional retail banking trojans that steal consumer credentials, Carbanak infiltrated the internal corporate and operations networks of over 100 banks, financial institutions, and currency exchanges across 40 countries—amassing over $1 billion in stolen funds. The operators performed meticulous lateral movement, surveilling bank employees via video capture to learn daily accounting workflows, before executing targeted money transfers over the SWIFT interbank network, altering Oracle database account balances, and commanding infected ATMs to dispense cash at predetermined times to physical money mule networks.\n\nIn March 2018, Spanish National Police, Europol, the FBI, and Romanian and Taiwanese authorities apprehended the alleged Carbanak syndicate ringleader (Denis Tokarenko, known as Denis Katana) in Alicante, Spain. Subsequently, the US Department of Justice (Western District of Washington) indicted several key FIN7/Carbanak managers and engineers, dismantling major portions of the group's operational infrastructure.", "cta": "Published by the SystemHelpdesk team.", "aliases": [ "Carbanak", "Anunak", "FIN7 Toolkit", "Trojan.Carbanak", "Win32/Carbanak" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is Carbanak / Anunak?", "acceptedAnswer": { "@type": "Answer", "text": "Carbanak (also called Anunak) is an advanced financial cyber-heist malware framework used by cybercrime syndicates to steal over $1 billion from more than 100 banks worldwide." } }, { "@type": "Question", "name": "How did Carbanak operators steal money from banks?", "acceptedAnswer": { "@type": "Answer", "text": "Operators monitored bank employee screens to learn internal operations, then initiated rogue SWIFT fund transfers, manipulated Oracle database account balances, and forced automated teller machines (ATMs) to spit out cash." } }, { "@type": "Question", "name": "Was anyone arrested in connection with Carbanak?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, Spanish National Police and Europol arrested the syndicate mastermind Denis Tokarenko in Alicante in 2018, and multiple FIN7 leaders were convicted and sentenced in US federal court." } }, { "@type": "Question", "name": "What vulnerabilities did Carbanak abuse?", "acceptedAnswer": { "@type": "Answer", "text": "Carbanak operators weaponized Microsoft Office vulnerabilities including CVE-2012-0158, CVE-2013-3906, and CVE-2014-1761 in spear-phishing campaigns." } }, { "@type": "Question", "name": "How do financial institutions protect against Carbanak?", "acceptedAnswer": { "@type": "Answer", "text": "Financial institutions enforce dual-custody authorization for high-value funds transfers, restrict administrative access to SWIFT and core banking databases, and deploy behavioral anomaly detection on internal workstations." } } ], "faq_count": 5, "mitre_attack": [ "T1055", "T1056.001", "T1113", "T1021.001", "T1543.003", "T1071.001" ], "cisa_advisory": null, "last_updated": "2026-06-09", "mitre_attack_detail": [ { "id": "T1125", "name": "Video Capture (Recording clerks to learn banking procedures)", "tactic": "Collection" }, { "id": "T1566.001", "name": "Phishing: Spearphishing Attachment", "tactic": "Initial Access" }, { "id": "T1021", "name": "Remote Services (Lateral movement to critical bank infrastructure)", "tactic": "Lateral Movement" }, { "id": "T1488", "name": "Disk Wipe (Sometimes used to cover tracks after a heist)", "tactic": "Impact" } ], "containment_steps": [ "If Carbanak is suspected, declare a major incident. The network is deeply compromised by skilled, human operators.", "Identify and isolate the compromised internal administration and financial control servers (SWIFT terminals, ATM management servers).", "Perform a massive enterprise-wide credential reset, as the attackers have likely dumped domain admin hashes.", "Engage specialized incident response firms; eradicating an established APT group requires comprehensive network hunting and re-architecture." ], "what_to_avoid": [ "Do not assume the attack is automated; human operators are actively navigating the network and adapting to defensive measures.", "Avoid tipping off the attackers; if they detect remediation efforts, they may execute immediate, destructive actions (like data wiping) to cover their tracks." ], "target_industries": [ "Global / Opportunistic" ], "motivation": "Opportunistic", "threat_actors": [ "Unknown / Cybercriminal" ], "target_geographies": [ "Global" ], "attack_stage": [ "execution", "persistence" ], "ecosystem": [ "windows_pe" ], "is_emerging": false, "first_seen": 2013, "lineage": { "derived_from": [], "variants": [ "anunak v1.0", "carbanak banking core", "fin7 carbanak fork", "carbanak source leak (2018)" ] }, "attribution": [ { "actor": "FIN7 / Carbanak Cybercrime Syndicate (Denis Tokarenko / Denis Katana)", "confidence": "high", "basis": "Europol EC3 and Spanish National Police operation arresting Denis Katana in Alicante in March 2018, followed by US Department of Justice indictments against FIN7 leaders Fedir Hladyr, Dmytro Fedorov, and Andrii Kolpakov.", "source": "https://www.europol.europa.eu/media-press/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain" } ], "exploited_cves": [ "CVE-2012-0158", "CVE-2013-3906", "CVE-2014-1761" ], "c2_profile": { "protocols": [ "HTTP", "HTTPS", "TCP Binary Protocol", "Encrypted Reverse SOCKS Tunnel" ], "ports": [ 443, 80, 25, 4443 ], "infrastructure": "Multi-hop reverse proxies using encrypted bidirectional SSL tunnels allowing operators to route interactive VNC sessions and remote desktop streams straight into bank intranets." }, "iocs": { "file_hashes": [ "0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c", "4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b" ], "delivery": [ "Targeted spear-phishing emails to banking staff disguised as regulatory notices or vendor payment requests containing CVE-2012-0158 and CVE-2014-1761 exploits", "Weaponized Microsoft Office documents executing embedded VBS and PowerShell scripts" ], "persistence": [ "Hidden Windows service installation registered under legitimate-appearing names (e.g., svchost or audiosrv)", "Injection into svchost.exe and explorer.exe to maintain persistent background execution" ] }, "sources": [ { "name": "Europol Press Release - Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested", "url": "https://www.europol.europa.eu/media-press/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain" }, { "name": "US DOJ WDWA FIN7 Syndicate Indictments", "url": "https://www.justice.gov/opa/pr/three-members-notorious-international-cybercrime-group-fin7-custody-role-attacks-more-100" }, { "name": "MITRE ATT&CK - Carbanak (S0030)", "url": "https://attack.mitre.org/software/S0030/" } ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }