1. Home
  2. Groups
  3. Carbanak

Carbanak

Carbanak is a cybercriminal group that has used Carbanak malware to target financial institutions since at least 2013. Carbanak may be linked to groups tracked separately as Cobalt Group and FIN7 that have also used Carbanak malware.[1][2][3][4][5]

ID: G0008
ⓘ
Associated Groups: Anunak
Contributors: Anastasios Pingios
Version: 2.0
Created: 31 May 2017
Last Modified: 18 October 2021
Version Permalink

Associated Group Descriptions

Name Description
Anunak

[6]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1543 .003 Create or Modify System Process: Windows Service

Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.[1]
Enterprise T1562 .004 Impair Defenses: Disable or Modify System Firewall

Carbanak may use netsh to add local firewall rule exceptions.[7]
Enterprise T1036 .004 Masquerading: Masquerade Task or Service

Carbanak has copied legitimate service names to use for malicious services.[1]
.005 Masquerading: Match Legitimate Name or Location

Carbanak has named malware "svchost.exe," which is the name of the Windows shared service host program.[1]
Enterprise T1588 .002 Obtain Capabilities: Tool

Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.[1]
Enterprise T1219 Remote Access Software

Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.[7]
Enterprise T1218 .011 System Binary Proxy Execution: Rundll32

Carbanak installs VNC server software that executes through rundll32.[1]
Enterprise T1078 Valid Accounts

Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.[1]
Enterprise T1102 .002 Web Service: Bidirectional Communication

Carbanak has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.[8]

Software

ID Name References Techniques
S0030 Carbanak [1] Application Layer Protocol: Web Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Create Account: Local Account, Data Encoding: Standard Encoding, Data Transfer Size Limits, Email Collection: Local Email Collection, Encrypted Channel: Symmetric Cryptography, Indicator Removal: File Deletion, Input Capture: Keylogging, Obfuscated Files or Information, OS Credential Dumping, Process Discovery, Process Injection: Portable Executable Injection, Query Registry, Remote Access Software, Remote Services: Remote Desktop Protocol, Screen Capture
S0002 Mimikatz [1] Access Token Manipulation: SID-History Injection, Account Manipulation, Boot or Logon Autostart Execution: Security Support Provider, Credentials from Password Stores, Credentials from Password Stores: Credentials from Web Browsers, Credentials from Password Stores: Windows Credential Manager, OS Credential Dumping: DCSync, OS Credential Dumping: Security Account Manager, OS Credential Dumping: LSASS Memory, OS Credential Dumping: LSA Secrets, Rogue Domain Controller, Steal or Forge Authentication Certificates, Steal or Forge Kerberos Tickets: Golden Ticket, Steal or Forge Kerberos Tickets: Silver Ticket, Unsecured Credentials: Private Keys, Use Alternate Authentication Material: Pass the Hash, Use Alternate Authentication Material: Pass the Ticket
S0108 netsh [7] Event Triggered Execution: Netsh Helper DLL, Impair Defenses: Disable or Modify System Firewall, Proxy, Software Discovery: Security Software Discovery
S0029 PsExec [1] Create Account: Domain Account, Create or Modify System Process: Windows Service, Lateral Tool Transfer, Remote Services: SMB/Windows Admin Shares, System Services: Service Execution

References

  1. Kaspersky Lab's Global Research and Analysis Team. (2015, February). CARBANAK APT THE GREAT BANK ROBBERY. Retrieved August 23, 2018.
  2. Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
  3. Europol. (2018, March 26). Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested in Spain. Retrieved October 10, 2018.
  4. CTU. (n.d.). GOLD NIAGARA. Retrieved September 21, 2021.
  1. Secureworks. (n.d.). GOLD KINGSWOOD. Retrieved October 18, 2021.
  2. Prins, R. (2015, February 16). Anunak (aka Carbanak) Update. Retrieved January 20, 2017.
  3. Group-IB and Fox-IT. (2014, December). Anunak: APT against financial institutions. Retrieved April 20, 2016.
  4. Griffin, N. (2017, January 17). CARBANAK GROUP USES GOOGLE FOR MALWARE COMMAND-AND-CONTROL. Retrieved February 15, 2017.