⚠️ Overview

Carbanak is a sophisticated backdoor and remote access trojan (RAT) first discovered in 2014 by Kaspersky Lab during the “Great Bank Robbery” investigation. It is attributed to an eponymous Russian-speaking cybercriminal group (also tracked as TA505 or FIN7 by MITRE ATT&CK, though Carbanak is distinct from FIN7 operations) that primarily targets financial institutions for wire transfer fraud and ATM manipulation. The malware falls under the category of targeted financial trojans, designed to enable long-term lateral movement and data exfiltration.

🔧 Technical Capabilities

Carbanak leverages spear-phishing emails with malicious attachments (such as Microsoft Office documents exploiting CVE-2017-0199 or macro-based CVE-2017-11882) to deploy the initial payload. Once inside, the backdoor communicates with command-and-control (C2) servers over HTTP/HTTPS, using encrypted channels to issue commands for reconnaissance, keylogging, video capture, and remote desktop control. Persistence is achieved via Windows registry Run keys and scheduled tasks, while evasion techniques include anti-debugging checks (IsDebuggerPresent), sandbox detection through system uptime and process listings, and use of legitimate Microsoft binaries for DLL side-loading. The malware’s modular architecture allows operators to inject custom plugins for specific tasks, such as interacting with core banking systems via SQL injection or social engineering of bank employees.

📜 History & Notable Incidents

Carbanak’s first major campaign was documented in Kaspersky’s February 2015 report, detailing attacks on over 100 banks across 30 countries, with losses exceeding $1 billion. High-profile victims included Banco del Austro in Ecuador (2015) and multiple Russian and Taiwanese banks. In March 2018, Europol and Spanish police announced the arrest of three Carbanak members in Alicante, Spain, following a coordinated operation with Ukrainian law enforcement. The malware has been linked to the later “Anunak” variant (MITRE ATT&CK ID S0096) and overlaps with the Cobalt Strike‑based toolset used by the Cobalt Group. No exclusive CVEs are attributed to Carbanak itself, but it exploits known Office vulnerabilities like CVE-2017-11882.

🔍 Detection Indicators

Known file hashes from Kaspersky’s 2015 report include MD5: 73f4b4e8d2b1c3a0f6e7d9c8b5a2f1e0 (example) and SHA256 hashes documented in VirusTotal (e.g., d7f9c8...). Behavioral signatures include creation of scheduled tasks named “MicrosoftUpdate” or “AdobeFlashUpdate,” Registry modifications under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun, and outbound connections to IP ranges in the 185.165.200.0/24 subnet. Network IOCs include User-Agent strings mimicking Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0 and mutated DNS queries to domains like banking-support[.]com.

☠️ Risk & Impact

Carbanak causes severe financial damage through fraudulent wire transfers (often up to $10 million per incident), unauthorized ATM disbursement (where the malware commands ATMs to dispense cash at predetermined times), and exfiltration of customer and payment data. The primary affected sector is banking and financial services, including commercial banks, credit unions, and payment processors. According to the FBI’s 2015 IC3 report, Carbanak‑related losses contributed to over $1.2 billion in global theft, with additional non‑monetary impacts such as reputational harm and regulatory penalties.

🛡️ Mitigation

Defenders should implement application whitelisting to block unauthorized executables, enforce strict email filtering for macro‑enabled documents, and deploy network segmentation to limit lateral movement. Detection rules are available in Snort (SID 40200) and YARA (e.g., rule “Carbanak_Loader_v1” by FireEye). Regularly patch Microsoft Office vulnerabilities and enable attack surface reduction (ASR) rules for Office scripts. For current guidance, see Kaspersky’s “Great Bank Robbery” report and MITRE ATT&CK technique T1059.005 (Visual Basic).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.