{
  "family": "carbanak",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Carbanak (also known as Anunak) represents a watershed moment in cybercrime. It is not just a banking trojan; it is a highly sophisticated Advanced Persistent Threat (APT) framework used by a massive organized crime syndicate. Unlike traditional trojans that steal credentials from end-users, Carbanak was used to directly infiltrate the internal networks of financial institutions, resulting in the theft of an estimated $1 Billion globally by taking direct control of bank systems and ATMs.<br><br><b>Understanding Carbanak (APT Campaign)</b><br>To an infected bank employee, Carbanak was invisible. For the financial industry, Carbanak was a paradigm shift. The attackers operated exactly like nation-state espionage groups. They did not rely on automated fraud; they maintained long-term persistence in the bank's network, learned internal procedures, and then manually executed massive, coordinated heists.<br><br><b>Execution and the 'Great Bank Heist' Mechanics</b><br>Initial access was gained via highly targeted spear-phishing emails (`T1566.001`) sent to bank employees, containing exploits (e.g., CVE-2012-0158 in Word/Excel). Once a foothold was established, the Carbanak backdoor was deployed. Attackers used legitimate admin tools (Ammyy Admin, PsExec - `T1569.002`) to move laterally (`T1021`) until they reached the administrator networks. Crucially, they utilized the malware's screen and video recording capabilities (`T1125`) to spy on banking clerks for months, learning the exact procedures for the SWIFT network and internal accounting systems. Finally, they struck: inflating account balances and transferring the excess via SWIFT, or remotely commanding ATMs (`T1488`) across the country to dispense cash to waiting 'mules' at specific times.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was devastating, direct financial loss at an institutional scale. Host-based IoCs included the presence of the `svchost.exe` process (Carbanak often disguised itself this way, but running from unexpected directories), unauthorized installations of Ammyy Admin, and unexpected modifications to the registry (`T1547.001`). Network IoCs involved persistent outbound connections to C2 servers over ports 80 and 443, and anomalous internal lateral movement targeting financial control servers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1488",
    "T1566.001",
    "T1125",
    "T1021"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1125",
      "name": "Video Capture (Recording clerks to learn banking procedures)",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1021",
      "name": "Remote Services (Lateral movement to critical bank infrastructure)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1488",
      "name": "Disk Wipe (Sometimes used to cover tracks after a heist)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "If Carbanak is suspected, declare a major incident. The network is deeply compromised by skilled, human operators.",
    "Identify and isolate the compromised internal administration and financial control servers (SWIFT terminals, ATM management servers).",
    "Perform a massive enterprise-wide credential reset, as the attackers have likely dumped domain admin hashes.",
    "Engage specialized incident response firms; eradicating an established APT group requires comprehensive network hunting and re-architecture."
  ],
  "what_to_avoid": [
    "Do not assume the attack is automated; human operators are actively navigating the network and adapting to defensive measures.",
    "Avoid tipping off the attackers; if they detect remediation efforts, they may execute immediate, destructive actions (like data wiping) to cover their tracks."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}