Carbanak

Description

Carbanak (a.k.a. Anunak) is a backdoor and trojan associated with the FIN7 threat group that targets financial institutions, retailers, and hospitality companies for espionage and financial theft. Operators use it to survey banking environments, capture credentials, and move to systems that process high value transactions, and campaigns have extracted sums estimated in the hundreds of millions of dollars. The group combines targeted phishing and infrastructure intrusions, and its tooling has evolved continuously since the family first surfaced in the mid 2010s.

Stats

First seen: March 2022
Last seen: October 2026

Also known as

Anunak

MITRE ATT&CK techniques

18 techniques across 9 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell

TA0003 Persistence

T1136Create Account
- T1136.001Local Account
T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
T1055Process Injection
- T1055.002Portable Executable Injection
T1070Indicator Removal
- T1070.004File Deletion

TA0006 Credential Access

T1003OS Credential Dumping

TA0007 Discovery

T1012Query Registry
T1057Process Discovery

TA0008 Lateral Movement

T1021Remote Services
- T1021.001Remote Desktop Protocol

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1113Screen Capture
T1114Email Collection
- T1114.001Local Email Collection

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1132Data Encoding
- T1132.001Standard Encoding
T1219Remote Access Tools
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0010 Exfiltration

T1030Data Transfer Size Limits

Associated groups

Alert name variants

Alert Name	Engine
Document-OLE.Backdoor.Carbanak	ATP Sandbox Adv. Heuristics
Document-RTF.Trojan.Carbanak	ATP Sandbox Adv. Heuristics
Dump:Generic.CBL.Carbanak.1.FFFFFFFE	ATP Sandbox Adv. HeuristicsAV
Generic.BAT.Carbanak.1.9985FA7D	AV
Generic.CBL.Carbanak.1.7547EEA6	AV
Generic.CBL.Carbanak.1.7776416C	AV
Generic.CBL.Carbanak.1.C2C718C6	AV
Generic.JVL.Carbanak.5.15FC9636	AV
Generic.JVL.Carbanak.5.B075A8EE	AV
Generic.JVL.Carbanak.5.DE7CD1C0	AV
Generic.JVL.Carbanak.5.DE7CD1C0:0FE0E	ATP Sandbox Adv. Heuristics
Generic.Llr.Carbanak.1.4D460A41	AV
Generic.PwShell.Carbanak.1.A7CDE132	AV
Linux.Backdoor.Carbanak	ATP Sandbox Adv. Heuristics
Script-BAT.Trojan.Carbanak	ATP Sandbox Adv. Heuristics
Script-INF.Trojan.Carbanak	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.Carbanak	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.Carbanak	ATP Sandbox Adv. Heuristics
Script-WScript.Downloader.Anunak	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.Carbanak	ATP Sandbox Adv. Heuristics
Win32.Backdoor.Carbanak	ATP Sandbox Adv. Heuristics
Win32.Trojan.Carbanak	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Carbanak	ATP Sandbox Adv. Heuristics
Win64.Trojan.Carbanak	ATP Sandbox Adv. Heuristics