Carbanak - G0008

Created: 2017-05-31T21:31:49.021Z

Modified: 2021-10-18T21:02:30.899Z

Contributors: Anastasios Pingios

Aliases

Carbanak,Anunak

Description

Carbanak is a cybercriminal group that has used

Carbanak malware to target financial institutions since at least 2013.

Carbanak may be linked to groups tracked separately as

Cobalt Group and

FIN7 that have also used

Carbanak malware.(Citation: Kaspersky Carbanak)(Citation: FireEye FIN7 April 2017)(Citation: Europol Cobalt Mar 2018)(Citation: Secureworks GOLD NIAGARA Threat Profile)(Citation: Secureworks GOLD KINGSWOOD Threat Profile)

Techniques Used

Carbanak has obtained and used open-source tools such as

PsExec and

Mimikatz.(Citation: Kaspersky Carbanak)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Carbanak has copied legitimate service names to use for malicious services.(Citation: Kaspersky Carbanak)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.(Citation: Group-IB Anunak)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

Carbanak installs VNC server software that executes through rundll32.(Citation: Kaspersky Carbanak)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.(Citation: Kaspersky Carbanak)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1562.004|Disable or Modify System Firewall|

Carbanak may use