carbanak

Carbanak (also tracked as Anunak, Carbanak Group, Carbanak APT, Cobalt Group, Cobalt Spider, ITG13, TAG-CR1, and MITRE ATT&CK G0008) is one of the most operationally consequential and analytically foundational organized cyber-criminal clusters in the publicly-tracked record, a Russian-speaking financially- motivated cluster active since at least 2013 from Russia, Ukraine, and adjacent post-Soviet states. The cluster is documented as having stolen more than one billion US dollars from financial institutions globally per the seminal Kaspersky GReAT February 16, 2015 disclosure "Carbanak APT: The Great Bank Robbery", making Carbanak's documented financial impact among the highest of any single publicly-tracked organized cybercrime cluster in the publicly-tracked record. The cluster's earliest seminal disclosure was Group-IB's December 2014 "Anunak: APT Against Financial Institutions" documenting approximately two years of previously-undocumented Anunak operations against Russian and Ukrainian financial institutions with documented theft of approximately twenty-five million US dollars during the 2013-2014 period. The Group-IB Anunak disclosure was followed approximately two months later by Kaspersky's February 2015 Carbanak disclosure documenting the substantially-broader global scope of cluster operations against at least one hundred banks across at least thirty countries and the substantially-larger cumulative financial impact exceeding one billion US dollars. The two disclosures collectively established the cluster as a foundational reference for organized-cybercrime-against-financial-institutions analytical frameworks. The cluster's three primary signature monetization tradecraft patterns, established in operations across 2013-2018 and operationally consequential beyond the specific cluster, were: First, SWIFT manipulation for fraudulent wire transfers. The cluster used direct bank-internal-network compromise to access bank SWIFT terminals and authorize fraudulent SWIFT wire transfers to attacker-controlled accounts. The SWIFT-manipulation tradecraft influenced subsequent state-aligned cluster operations , notably the Lazarus Group SWIFT-targeting tradecraft documented in the February 2016 Bangladesh Bank attack (covered in this corpus via lazarus_group.yaml and apt38_bluenoroff.yaml). Carbanak's direct-bank-network-compromise-and-SWIFT-manipulation tradecraft represented one of the first major non-state-aligned threats to SWIFT financial infrastructure. Second, ATM jackpotting via coordinated remote commanding of compromised bank ATMs to dispense cash at specific times to money-mules waiting at the ATMs. The tradecraft required bank- internal-network compromise to access ATM management systems (typically Microsoft Windows-based ATM management software running on bank internal servers), reconnaissance of ATM network topology, identification of suitable ATM locations in cities with available money-mule networks, and coordination of money- mule deployment with timed ATM dispensing commands. The tradecraft was operationally consequential and represented one of the first major examples of cyber-intrusion-and-physical-money-mule- logistics convergence in organized cybercrime. The tradecraft influenced subsequent ATM-targeting tooling including Tyupkin, Ploutus, CutletMaker, and the broader ATM-malware ecosystem. Third, database manipulation in bank internal financial systems , notably increasing the apparent account balance of attacker- controlled accounts to enable subsequent ATM cash withdrawals and wire transfers. The tradecraft represented sophisticated understanding of bank internal financial-system architecture and operational discipline in modifying financial-system state to enable monetization while avoiding immediate detection. Operationally the cluster's signature toolkit centered on the Carbanak backdoor (the cluster's namesake Windows implant providing extensive command execution, file collection, screenshot capture, keylogging, and network-lateral-movement capability) alongside the Anunak / Carbanak malware family, Cobalt Strike Beacon (used extensively especially during the Cobalt Group operational era), MoreEggs, TerraLoader, Bateleur, various ATM-jackpotting tools (including Tyupkin and Ploutus variants), and selected commodity tools (Mimikatz, PsExec, HTRAN). The Carbanak backdoor source code was publicly leaked in April 2019 (per FireEye / Mandiant disclosure of discovery of the source-code upload to VirusTotal from a Russian IP address). The source code leak was operationally consequential because it enabled subsequent broader use of the Carbanak codebase by additional cluster operators, making Carbanak- backdoor-presence-alone insufficient for original-cluster attribution in the modern era. The most operationally significant law-enforcement action against the cluster was the March 26, 2018 Spanish National Police arrest in Alicante Spain of an alleged Carbanak / Cobalt Group cluster leader (referred to in public reporting as "Denis K." with disputed full-name attribution across vendor sources). The arrest was supported by Europol, US FBI, Belarusian, Taiwanese, and Romanian law-enforcement coordination via the Joint Cybercrime Action Taskforce (J-CAT). The arrest represented one of the most significant individual-operator arrests of any organized cybercrime cluster leader in the publicly-tracked record. No further individual-operator indictments or sanctions designations have been publicly issued for Carbanak administrators at the named-Russian-national tier comparable to the Khoroshev LockBit or Yakubets Evil Corp designations. A handful of operational notes: First, the cluster's relationship with FIN7 (already covered as fin7.yaml) has been analytically open across vendor reporting. Some vendors treat FIN7 as ecosystem-adjacent to the Carbanak cluster or as a related sub-cluster within the broader Carbanak operational ecosystem.

other vendors treat the two as distinct cluster identities. Modern vendor consensus treats Carbanak and FIN7 as distinct cluster identities within a broader Carbanak operational ecosystem with substantial personnel-overlap and tooling-overlap during early periods but separable operational identities by victim emphasis (FIN7 predominantly POS-systems at retail / restaurants / hospitality vs Carbanak predominantly direct bank-and-financial-institution compromise) and tradecraft. The two clusters should be treated as related-but-distinct in analytical framing. Second, the cluster represents one of the most operationally foundational organized-cybercrime-against-financial-institutions case studies in the publicly-tracked record. The Group-IB Anunak (December 2014) and Kaspersky Carbanak (February 2015) disclosures collectively established the broader threat- intelligence community understanding that organized cybercrime had evolved beyond commodity-malware monetization toward sophisticated direct-financial-institution-compromise operations , a foundational analytical framework shift that influenced subsequent organized-cybercrime tracking and defender threat- modeling for the financial-services sector. The cluster's operations also influenced subsequent state-aligned cluster operations against financial infrastructure including the Lazarus Group SWIFT-targeting and broader DPRK financial- cybercrime ecosystem. Third, the cluster's post-March-2018 operational status has been analytically complex. The Spanish arrest disrupted but did not fully eliminate cluster operations. The April 2019 Carbanak source code leak further complicated attribution, Carbanak- backdoor-based operations have surfaced under multiple subsequent cluster identities across 2019-2024 making Carbanak-backdoor- presence-alone insufficient for original-cluster attribution in the modern era. The broader Carbanak operational ecosystem evolution has been documented across multiple years feeding into FIN7 operational continuation, into the broader Russia-speaking organized cybercrime ecosystem, and into selected adjacent operations. Fourth, the cluster is one of the central reference clusters for understanding the broader Russia-speaking organized cybercrime ecosystem of the 2013-2018 era. The cluster's operational scale, tradecraft sophistication, and demonstrated capability for direct bank-network-compromise-and-SWIFT- manipulation represented a meaningful inflection point in organized-cybercrime evolution and continues to inform defender threat-modeling for sophisticated financial-services targeting.

Profile

Aliases

Notable Campaigns

Attribution & Reporting

Operational

Techniques Used

Detection Blind Spots

Atomic Test Plan

Tools Used

CVEs Exploited