Carbanak

Overview

Carbanak (also cataloged across international law enforcement and intelligence communities as Anunak) is an elite, multi-million dollar cyber heist malware framework first detected in 2013. Developed and deployed by the notorious FIN7 and Carbanak cybercrime syndicates, the malware was engineered for targeted financial espionage, remote bank intranet infiltration, and massive fraudulent asset liquidation. Unlike conventional retail banking trojans that steal consumer credentials, Carbanak infiltrated the internal corporate and operations networks of over 100 banks, financial institutions, and currency exchanges across 40 countries—amassing over $1 billion in stolen funds. The operators performed meticulous lateral movement, surveilling bank employees via video capture to learn daily accounting workflows, before executing targeted money transfers over the SWIFT interbank network, altering Oracle database account balances, and commanding infected ATMs to dispense cash at predetermined times to physical money mule networks. In March 2018, Spanish National Police, Europol, the FBI, and Romanian and Taiwanese authorities apprehended the alleged Carbanak syndicate ringleader (Denis Tokarenko, known as Denis Katana) in Alicante, Spain. Subsequently, the US Department of Justice (Western District of Washington) indicted several key FIN7/Carbanak managers and engineers, dismantling major portions of the group's operational infrastructure.

Known aliases

Threat reports may refer to this family under multiple names:

• Carbanak
• Anunak
• FIN7 Toolkit
• Trojan.Carbanak
• Win32/Carbanak

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• FIN7 / Carbanak Cybercrime Syndicate (Denis Tokarenko / Denis Katana) High confidence
  Basis: Europol EC3 and Spanish National Police operation arresting Denis Katana in Alicante in March 2018, followed by US Department of Justice indictments against FIN7 leaders Fedir Hladyr, Dmytro Fedorov, and Andrii Kolpakov. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Anunak V1.0 · Carbanak Banking Core · Fin7 Carbanak Fork · Carbanak Source Leak (2018)

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1125: Restrict access to local camera or microphone APIs. Utilize endpoint protection that monitors hardware access.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2012-0158 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2013-3906 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2014-1761 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c
• 4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b

Delivery vectors

• Targeted spear-phishing emails to banking staff disguised as regulatory notices or vendor payment requests containing CVE-2012-0158 and CVE-2014-1761 exploits
• Weaponized Microsoft Office documents executing embedded VBS and PowerShell scripts

Persistence mechanisms

• Hidden Windows service installation registered under legitimate-appearing names (e.g., svchost or audiosrv)
• Injection into svchost.exe and explorer.exe to maintain persistent background execution

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_CARBANAK_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Carbanak"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "carbanak" ascii wide nocase
        $s2 = "carbanak" ascii wide nocase
        $s3 = "anunak" ascii wide nocase
        $s4 = "fin7 toolkit" ascii wide nocase
        $s5 = "trojan.carbanak" ascii wide nocase
        $s6 = "win32/carbanak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Carbanak (Banking Trojan) Execution & Triage
id: 2de846e7-b616-54af-8a56-f44100cae1a9
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Carbanak malware family. Detects recon staging, certutil file payload staging,
  and web-inject process proxying characteristic of banking trojan initial loaders.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/carbanak
- https://malware-families-catalog.systemhelpdesk.com/defensive/banking-trojan-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.banking-trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1056_001
- attack.t1113
- attack.t1021_001
- attack.t1543_003
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \svchost.exe
    - \explorer.exe
    - \msiexec.exe
    - \certutil.exe
    CommandLine|contains:
    - -urlcache
    - -split -f
    - ipconfig /all
    - route print
    - netstat -ano
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_CARBANAK_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Carbanak tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "carbanak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. If Carbanak is suspected, declare a major incident. The network is deeply compromised by skilled, human operators.
2. Identify and isolate the compromised internal administration and financial control servers (SWIFT terminals, ATM management servers).
3. Perform a massive enterprise-wide credential reset, as the attackers have likely dumped domain admin hashes.
4. Engage specialized incident response firms; eradicating an established APT group requires comprehensive network hunting and re-architecture.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack is automated; human operators are actively navigating the network and adapting to defensive measures.
2. Avoid tipping off the attackers; if they detect remediation efforts, they may execute immediate, destructive actions (like data wiping) to cover their tracks.

References & External Analysis

• Europol Press Release - Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested
• US DOJ WDWA FIN7 Syndicate Indictments
• MITRE ATT&CK - Carbanak (S0030)
• Search "carbanak" on VirusTotal (External Analysis)
• Search "carbanak" on Any.Run (Sandbox Sandbox)
• Search "carbanak" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Banking Trojan)

Explore other documented threats in the same operational category:

• Gozi
• Tinynuke
• Vawtrak
• Icedid
• A_311_Death
• Mekotio
• Chthonic
• Zusy

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/carbanak.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.