Home

Carbanak (Anunak)

Financially motivated intrusion set · Active since 2013 · MITRE G0008

Overview

Carbanak is a cybercriminal intrusion set that has targeted financial institutions since at least 2013. MITRE ATT&CK tracks the group under G0008 with the associated name Anunak, and notes probable links to the separately tracked Cobalt Group and FIN7, both of which have used the same Carbanak backdoor. The group is also tracked as Carbon Spider, GOLD NIAGARA, Sangria Tempest (Microsoft), and ITG14.

Europol estimated cumulative losses from the original Carbanak bank-targeting campaign at up to EUR 1 billion across more than 100 financial institutions in over 40 countries. The campaign ran from approximately 2013 to 2018 and was distinctive for targeting banking infrastructure directly rather than individual account holders. Operators spent months recording screens and logging keystrokes to learn internal workflows before manufacturing fraudulent ATM cash disbursements, manipulating Oracle database balances, and redirecting SWIFT interbank transfers.

The group operated behind a front company, Combi Security, which recruited developers and operators under the pretense of legitimate penetration-testing work. Three Ukrainian nationals were indicted in 2018. Fedir Hladyr was sentenced to 10 years in federal prison in April 2021. Andrii Kolpakov received 7 years and $2.5 million in restitution in June 2021. A third member, Denys Iarmak, was sentenced in 2022. The enterprise did not stop after those convictions.

Since approximately 2020, the FIN7 cluster sharing Carbanak tooling pivoted to ransomware affiliate operations, gaining privileged corporate access and deploying ransomware as the final monetization step. Microsoft tracks this phase as Sangria Tempest, documenting exploitation of Exchange ProxyShell (CVE-2021-31207) and ZeroLogon (CVE-2020-1472). The tooling also evolved: GRIFFON (VBScript stager), Bateleur (JScript backdoor with sandbox detection), and JSS Loader joined the Carbanak backdoor depending on the campaign era.

Operational attack chain · Carbanak / FIN7
  1. Start

    Initial access

    Spearphishing .doc/.cpl · BadUSB · ProxyShell / ZeroLogon

  2. Stage 1

    Backdoor installed

    Carbanak / GRIFFON / Bateleur installs as Windows service with SYSTEM privileges

  3. Stage 2

    Weeks of reconnaissance

    VNC screen recording · keylogging · AdFind / csvde AD enumeration

  4. Stage 3

    Credential theft

    Mimikatz LSASS dump · DCSync · Kerberoasting

    MimikatzDCSyncPsExec
  5. Stage 4

    Lateral movement

    RDP · SMB admin shares · pass the hash · AmmyyAdmin · Cobalt Strike

  6. Impact

    Fraud or ransomware

    ATM / SWIFT manipulation · POS scraping · ransomware deployment

The initial access method varies by campaign era. Early operations used spearphishing documents; a later wave added mailed BadUSB devices; the ransomware-affiliate era added direct exploitation of Exchange and domain controllers. All paths converge on the same post-access playbook: extended reconnaissance, credential harvesting, lateral movement to high-value systems, then impact.

Tactics, techniques, and procedures

Carbanak and FIN7 are tracked separately by MITRE ATT&CK (G0008 and G0046) because multiple threat clusters have used the Carbanak backdoor. Their technique sets overlap substantially. The coverage below draws on both groups, weighted toward post-access behaviors most relevant to defenders. Every mapped technique is tied to documented behavior from DOJ filings, MITRE, Kaspersky, or Mandiant analysis.

MITRE ATT&CK coverageHeavyActiveNot observed
Recon0Resource Dev2Initial Access4Execution4Persistence3Priv. Esc2Defense Evasion4Credential Access4Discovery4Lateral3Collection3C23Exfiltration1Impact2
Technique detailKey techniques · G0008 Carbanak / G0046 FIN7
TacticTechniquesWhat Carbanak does
Initial Access
Spearphishing Attachment T1566.001Replication via Removable Media T1091Exploit Public-Facing App T1190Valid Accounts T1078
Early campaigns used spearphishing email with Word 97-2003 (.doc) or Control Panel Applet (.cpl) attachments exploiting CVE-2013-3906. FIN7 evolved to LNK files in ZIP archives and macro-enabled restaurant lures. A later wave mailed BadUSB devices (USB HID keyboard emulators) that injected keystrokes to open the Windows Run dialog and execute a PowerShell payload. In the ransomware-affiliate era, Exchange ProxyShell (CVE-2021-31207) and ZeroLogon (CVE-2020-1472) provided unauthenticated entry without user interaction.
Execution
Windows Command Shell T1059.003VBScript T1059.005Rundll32 T1218.011Exploit for Client Execution T1203
Document attachments execute shellcode that installs the Carbanak backdoor. The backdoor's VNC server component loads via rundll32.exe. GRIFFON is a VBScript stager that fingerprints the host and retrieves secondary payloads over HTTPS. Bateleur is a JScript backdoor with sandbox detection — it terminates in analysis environments. JSS Loader collects host data via WMI queries (Win32_ComputerSystem, Win32_Product, Win32_Process) before beaconing C2.
Persistence
Windows Service T1543.003Registry Run Keys T1547.001Scheduled Task T1053.005
Carbanak installs as a Windows service named after a legitimate Windows service, with the binary named svchost.exe outside System32. FIN7 scheduled tasks (e.g., AdobeFlashSync) re-establish C2 twice daily. Registry Run keys provide a fallback persistence mechanism alongside the service.
Privilege Escalation
Exploit for Priv Esc T1068Access Token Manipulation T1134
ZeroLogon (CVE-2020-1472) gives immediate domain administrator access by exploiting the Netlogon RPC authentication protocol with no prior credentials. ProxyShell yields SYSTEM on Exchange. Mimikatz performs token manipulation and DCSync attacks against domain controllers without requiring physical access.
Defense Evasion
Match Legitimate Name T1036.005Masquerade Task or Service T1036.004Obfuscated Files T1027File Deletion T1070.004
The backdoor binary is named svchost.exe and the service name copies a real Windows service. GRIFFON and Bateleur obfuscate their JScript payloads; Bateleur includes sandbox and VM detection — it terminates in analysis environments, producing false clean sandbox verdicts. The GGLDR variant routes C2 through Google Apps Script, Google Sheets, and Google Forms, making outbound connections appear as normal Google HTTPS traffic and bypassing domain-reputation blocking entirely. netsh adds local firewall exceptions for backdoor listeners.
Credential Access
LSASS Memory T1003.001DCSync T1003.006Kerberoasting T1558.003Keylogging T1056.001
The Carbanak backdoor runs a keylogger thread that monitors configured processes and ships keystroke data to C2, capturing banking application credentials and operator actions without touching credential stores directly. Mimikatz dumps LSASS memory and performs DCSync replication requests against domain controllers, recovering the full Active Directory credential database without physical DC access. Kerberoasting requests service tickets for SPN-registered accounts for offline cracking.
Discovery
Domain Account Discovery T1087.002Process Discovery T1057Query Registry T1012Security Software Discovery T1518.001
The Carbanak backdoor enumerates running processes and queries the registry to identify security software. Operators use AdFind and csvde.exe to export Active Directory accounts and group structure. Kaspersky's 2015 analysis documented operators spending 2 to 4 months inside victim networks, identifying ATM management interfaces, SWIFT operator workstations, and Oracle database servers before acting.
Lateral Movement
RDP T1021.001SMB Admin Shares T1021.002Pass the Hash T1550.002
RDP is the primary lateral movement method, using harvested credentials to log in interactively to servers identified during reconnaissance. SMB administrative shares and remote file copy move tools across the network. Pass the hash authenticates to systems using NTLM hashes from LSASS dumps, without requiring plaintext passwords. PsExec deploys payloads and executes commands on remote hosts. AmmyyAdmin and TeamViewer provide interactive access alongside the Carbanak VNC capability.
Collection
Keylogging T1056.001Screen Capture T1113Local Email Collection T1114.001
Screen capture and desktop video recording was central to the bank-targeting methodology — operators observed banking application workflows for weeks to learn exactly how to authorize fraudulent transactions. Keylogger threads captured credentials and transaction data. An HTTP form grabber monitored traffic for form submission data. Outlook data rounded out collection. The intelligence gathered here is what enabled fraud to pass internal bank controls.
Command and Control
Web Protocols (HTTP) T1071.001Web Service: Bidirectional T1102.002Encrypted Channel T1573.001
The Carbanak backdoor communicates via HTTP with an encrypted payload. A documented GRIFFON variant named "ggldr" routed C2 commands through Google Apps Script, Google Sheets, and Google Forms — indistinguishable from normal browser traffic at the perimeter. AmmyyAdmin and TeamViewer provided interactive channels alongside the automated backdoor. Port/protocol mismatches on ports 53, 80, 443, and 8080 appear when C2 is configured for stealth.
Exfiltration
Exfil Over C2 Channel T1041
Keystroke logs, screen recordings, and credential material are transmitted over the same encrypted HTTP channel used for command delivery. Data transfer size is chunked and throttled (T1030) to avoid triggering volume-based anomaly detection. In the FIN7 POS era, card data was exfiltrated over C2 before being sold underground.
Impact
Financial Extortion T1657Data Encrypted for Impact T1486
In the bank era, operators manipulated Oracle database balances, instructed ATM management systems to dispense cash at controlled times, and redirected SWIFT interbank transfers — individual theft amounts ranged from $2.5 million to $10 million per institution (Kaspersky). In the FIN7 POS phase, Pillowmint scraped 15+ million card records from 3,600+ business locations (DOJ). In the post-2020 ransomware-affiliate phase, the same intrusion capability was monetized through REvil, DarkSide, and BlackMatter deployments.
Recon / Resource Dev—Not mapped in G0008. Target selection was handled externally before phishing or exploitation was initiated.
Stage 1T1566.001 · T1091 · T1190 · T1203

How the attack starts

Early Carbanak campaigns targeted bank employees with spearphishing emails carrying Word 97-2003 (.doc) or Control Panel Applet (.cpl) file attachments. Opening the attachment executed shellcode that installed the Carbanak backdoor — based on the Carberp source code and documented by Kaspersky in 2015. FIN7 iterated on delivery across years of operation, moving to LNK files in ZIP archives and macro-enabled Word documents using restaurant and catering lures aimed at the hospitality sector.

A physically delivered variant used USB devices resembling gift cards, mailed to target employees. The devices emulated HID keyboards and injected keystrokes to open the Windows Run dialog and execute a PowerShell payload — bypassing email security controls with no document interaction required from the victim.

ClickFix is not the only delivery vector. In the post-2020 ransomware-affiliate phase, direct exploitation replaced social engineering for high-value corporate networks. CVE-2021-31207 (ProxyShell) and CVE-2020-1472 (ZeroLogon) provided unauthenticated entry to Exchange servers and domain controllers respectively. These vectors skip the phishing stages and enter the kill chain at Stage 2 (backdoor installation). Detection coverage for these paths relies on stages 2 through 4 rather than document-execution correlation.

Stage 2T1543.003 · T1056.001 · T1113 · T1219

The Carbanak backdoor

The Carbanak backdoor is a full-featured remote access tool with a plugin architecture. Its core capability set, documented in Mandiant's 2017 analysis, includes keylogging, desktop video capture, VNC remote access, HTTP form grabbing, file system management, file transfer, TCP tunneling, HTTP proxy, POS monitoring, and reverse shell execution. Persistence is achieved by installing the backdoor as a Windows service with the binary named svchost.exe placed outside System32 and the service name copied from a legitimate Windows service to resist casual review.

Carbanak service installation — binary masquerading as svchost
sc create [LegitServiceName] binPath= "C:\Windows\svchost.exe" start= auto
sc description [LegitServiceName] "[Description copied from legitimate service]"

Pattern documented in Kaspersky Carbanak APT report (2015) and MITRE ATT&CK S0030

What distinguished Carbanak from most banking malware was operational patience. Operators spent weeks to months inside victim networks before acting. Screen recording captured exactly how bank employees performed transactions, which internal systems they accessed, and what the normal workflow looked like. Keylogging accumulated application passwords, operator credentials, and transaction authorization codes. This intelligence let operators craft fraudulent transactions that mimicked legitimate operator behavior — passing internal bank controls that would flag out-of-pattern external activity.

Other delivery variants in the FIN7 era:

  • GRIFFON VBScript stager: fingerprints the host and retrieves secondary payloads over HTTPS before staging heavier tooling
  • Bateleur JScript backdoor: includes anti-sandbox and anti-VM checks — terminates in analysis environments, producing false clean verdicts
  • JSS Loader: beacons C2 and enumerates host via WMI, acting as a lightweight reconnaissance and staging tool
Stage 3T1036.005 · T1027 · T1102.002

Service masquerading, obfuscation, and cloud-service C2

Carbanak's evasion strategy is built around looking legitimate rather than hiding from endpoint tools at the kernel level. The service masquerade — naming the backdoor binary svchost.exe and copying a real Windows service name — passes visual review of the service list without triggering file-name-based detection.

Bateleur specifically checks for common analysis tools, virtual machine indicators, and sandbox behaviors, terminating without executing if it detects an analysis environment. A sandbox verdict of "clean" for a FIN7 document should be treated with skepticism — behavioral detection on production endpoints using process-lineage rules is more reliable than sandbox verdicts alone for this actor.

The most architecturally distinctive evasion is the Google-service C2 channel. A GRIFFON variant named "ggldr" routed C2 commands entirely through Google Apps Script, Google Sheets, and Google Forms. Outbound connections went to Google infrastructure on standard HTTPS ports — indistinguishable from normal browser traffic. This bypassed domain-reputation blocking and made C2 infrastructure resilient to takedowns, since blocking Google's own services is not operationally feasible.

Stage 4T1003.006 · T1021.001 · T1657 · T1486

Credential theft and impact

The Carbanak bank-targeting methodology targeted financial infrastructure directly. After months of reconnaissance, operators identified ATM management servers (where they could instruct machines to dispense cash synchronized with money mule networks), Oracle database servers (where they could modify balances and create accounts for fund transfers), and SWIFT operator workstations (where they could authorize interbank transfers). Individual theft amounts ranged from $2.5 million to $10 million per institution.

Mimikatz DCSync. DCSync lets Mimikatz request a domain controller to replicate all password hashes via the standard AD replication protocol — without needing physical access to the DC and without writing anything to the DC's disk. Any process on a member server can issue this request once it has the necessary AD rights (obtained through credential escalation). The attack is the AD equivalent of walking out with every user's password.

Mimikatz DCSync — pull all domain hashes without touching the DC
mimikatz # lsadump::dcsync /domain:corp.local /all /csv

Documented in MITRE ATT&CK T1003.006; Carbanak / FIN7 use confirmed in DOJ filings and Mandiant analysis

The FIN7 POS-targeting phase deployed Pillowmint to scrape payment card data from restaurant, hospitality, and retail POS terminals after the same post-access playbook. The DOJ documented FIN7 stealing more than 15 million customer payment card records from over 6,500 POS terminals at more than 3,600 business locations across 47 U.S. states. The post-2020 ransomware-affiliate phase monetized the same intrusion capability through REvil, DarkSide, and BlackMatter, collecting a share of ransom payments as affiliates.

Process tree

What a Carbanak / FIN7 intrusion looks like in EDR telemetry

Indicators of compromise

The indicators below are durable: file paths, registry keys, process patterns, and network behaviors that remain consistent across Carbanak and FIN7 campaigns and survive variant rotation. Volatile indicators (hashes, IPs, domains) expire within days to weeks and should be sourced live from MITRE ATT&CK software pages S0030, S0417, S0648, and S0681 at the time of investigation.

File paths & binaries

4 indicators

Locations where Carbanak drops payload, persistence, or staging artifacts.

  • svchost.exe at non-System32 path (e.g. %ProgramData%\...)Carbanak backdoor binary; service name copied from legitimate Windows service
  • %AppData%\...\Temp\stager.vbsGRIFFON / Bateleur VBScript or JScript stager staging artifact
  • %TEMP%\*.exe (loader staging, deleted post-execution)JSS Loader / Bateleur staging; often self-deleted after payload execution
  • C:\ProgramData\users.csv (csvde AD export)Active Directory export staged to ProgramData for operator review

Registry keys

4 indicators

Registry locations Carbanak writes, reads, or leaves trace evidence in.

  • HKLM\...\Services\[copied service name]Carbanak Windows service registration; binary path points to non-System32 svchost.exe
  • HKCU\...\CurrentVersion\Run (unexpected binary path)Fallback Registry Run key persistence alongside Windows service
  • HKLM\...\TaskCache\Tasks (scheduled task masquerade)FIN7 scheduled task persistence; names like "AdobeFlashSync" masquerade as software maintenance
  • HKLM\...\Firewall\Rules (netsh exception for non-standard port)Carbanak uses netsh to open inbound exception for its backdoor listener

Process tree patterns

5 patterns

Parent-child execution chains that signal a Carbanak or FIN7 kill chain in progress.

  • WINWORD.EXE → wscript.exe / mshta.exeDocument executing a script interpreter; highest-fidelity initial-access signal
  • powershell.exe -enc [base64] -w hiddenGRIFFON / JSS Loader encoded PowerShell stager pattern
  • svchost.exe [non-System32] → rundll32.exe [vnc_server.dll]Carbanak VNC server component; service binary outside System32
  • mimikatz.exe → lsadump::dcsync / sekurlsa::logonpasswordsMimikatz DCSync and LSASS dump; documented across multiple Carbanak incidents
  • adfind.exe / csvde.exe outside IT change windowActive Directory bulk export; reliable discovery-stage indicator

Network behavior

4 patterns

Outbound traffic patterns observable at firewall, proxy, or DNS layer.

  • Google Apps Script / Sheets HTTPS from non-browser processGGLDR cloud-service C2 variant; looks like normal Google HTTPS traffic
  • HTTP POST with encoded payload from server assetsCarbanak C2: HTTP with encrypted payload; atypical from server-class hosts
  • Port-protocol mismatch on ports 53, 80, 443, or 8080C2 configured to use common ports with non-standard application-layer protocols
  • Large upload to consumer cloud storage from a server assetPre-ransomware data staging; documented in post-2020 FIN7 / Sangria Tempest operations

How Malware Protection Plus responds

A walkthrough showing detection of the document-to-script execution chain, the Carbanak service masquerade pattern, LSASS access, and DCSync activity, with automated endpoint containment before the attacker reaches high-value financial systems.

Detection guidance

Carbanak and FIN7 rely on legitimate administrative tools and valid credentials for most of the intrusion. Signature-based detection on known file hashes has limited reach — Bateleur actively evades sandboxes and tooling updates rotate hashes frequently. Behavioral correlation across process lineage, authentication logs, and network telemetry is what surfaces this actor reliably.

  1. 01

    Office application spawning a script interpreter

    Endpoint process telemetry

    Alert on WINWORD.EXE, EXCEL.EXE, or OUTLOOK.EXE spawning wscript.exe, cscript.exe, mshta.exe, or powershell.exe. Priority alert when the PowerShell child has -enc or -w hidden arguments.

    Why it works: legitimate documents almost never need to launch a script interpreter directly. This parent-child relationship is the primary execution signal for Carbanak's document-delivery phase and fires before the backdoor installs as a service. False positive note: some legacy line-of-business macros do call wscript; baseline known-good document templates before enforcing a hard block.

  2. 02

    Service binary path masquerade

    Endpoint / service telemetry

    Alert on new service creation events (Event ID 7045) where the binary path points to a file named svchost.exe outside C:\Windows\System32\, or where the service name matches a legitimate Windows service but the binary path does not match the expected System32 location.

    Why it works: Carbanak's core persistence mechanism is naming its service binary after a known Windows process. This signal holds across all Carbanak variants and does not rotate with tooling updates. A svchost binary outside System32 is almost never legitimate.

  3. 03

    DCSync replication request from a non-DC host

    Active Directory / domain controller telemetry

    Alert on Event ID 4662 showing a DS-Replication-Get-Changes-All or DS-Replication-Get-Changes access right from an account on a host that is not a domain controller.

    Why it works: DCSync allows Mimikatz to pull all password hashes from Active Directory without physically accessing the DC. Legitimate AD replication occurs only between domain controllers. A workstation or member server requesting these rights is almost never legitimate — it indicates active credential theft in progress.

  4. 04

    LSASS memory access from a non-system process

    EDR / API telemetry

    PROCESS_VM_READ handle opens to lsass.exe from any process other than known security or diagnostic tooling. Sysmon Event ID 10. Also alert on rundll32.exe comsvcs.dll MiniDump command-line patterns.

    Why it works: this is the direct mechanism Mimikatz and compatible tools use to recover credentials from memory. Legitimate processes rarely need this access — security software is the only common exception and should be baselined.

  5. 05

    Active Directory bulk enumeration outside change windows

    Process / LDAP telemetry

    Flag execution of adfind.exe, csvde.exe, or equivalent bulk AD export tooling and correlate against scheduled IT change tickets. Alert on bursts of LDAP queries from a single non-DC host enumerating user, computer, or group objects at volume.

    Why it works: full domain exports are routine for IT audits but rare outside them. An unscheduled bulk AD export is a reliable discovery-stage signal documented across multiple Carbanak and FIN7 incidents, firing well before lateral movement to financial systems begins.

  6. 06

    Google Cloud service connections from non-browser processes

    Network / proxy telemetry

    Monitor for outbound HTTPS connections to script.google.com, docs.google.com, or Google Sheets APIs from processes that are not browsers or known business applications, particularly from server-class machines.

    Why it works: the GGLDR C2 variant routes commands through legitimate Google infrastructure — standard domain-reputation controls cannot detect this. A server process connecting to Google Sheets is anomalous regardless of the destination domain's reputation, and process-context correlation is required to surface it.

Hardening recommendations

These controls target the specific entry paths and privilege escalation techniques Carbanak has used repeatedly across more than a decade of documented intrusions. Items are tagged by deployment difficulty. Quick win = single policy or configuration change, deployable in days. Standard = needs audit-mode rollout or compatibility testing, deployable in weeks.

  1. Disable Office macro execution from internet-sourced documents

    Quick win

    Blocking VBA macro execution in documents received from outside the organization directly disrupts Carbanak's document-delivery phase. For environments where macros are required, sign trusted macros and block unsigned ones rather than enabling macros globally.

    Path: User Configuration → Administrative Templates → Microsoft Office → Security Settings → Trust Center → Block macros from running in Office files from the Internet (Enabled).

  2. Patch Exchange and domain controllers for ProxyShell and ZeroLogon

    Critical

    CVE-2021-31207 (ProxyShell) and CVE-2020-1472 (ZeroLogon) are documented unauthenticated entry points in the FIN7/Sangria Tempest ransomware-affiliate phase and are both on CISA's Known Exploited Vulnerabilities catalog. Both have had patches available since 2020 and 2021 respectively.

    Path: Apply Exchange Cumulative Updates addressing ProxyShell and the ZeroLogon Netlogon security update. Verify patch status at cisa.gov/known-exploited-vulnerabilities-catalog.

  3. Enable LSASS protection and restrict DCSync rights

    Standard

    Windows Credential Guard virtualizes LSASS secrets and blocks Mimikatz-style dumps even when the attacker has admin rights. Protected LSASS (RunAsPPL) blocks arbitrary handle opens. Audit and restrict the DS-Replication-Get-Changes-All AD permission so only domain controllers hold it; any non-DC host requesting this right is anomalous.

    Path: Credential Guard via Computer Configuration → Administrative Templates → System → Device Guard. RunAsPPL via HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL = 1. Audit mode first.

  4. Enable PowerShell script block logging and Constrained Language Mode

    Quick win

    Script block logging (Event ID 4104) captures the decoded content of every PowerShell block before execution, including base64-encoded commands. This directly surfaces GRIFFON and JSS Loader stager activity. Constrained Language Mode restricts the PowerShell features attackers rely on for in-memory execution and reflection.

    Path: Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell → Turn on PowerShell Script Block Logging (Enabled). Pair with Constrained Language Mode via WDAC or AppLocker.

  5. Apply tiered administration and segment financial systems

    Standard

    Carbanak's bank-targeting methodology depended on reaching ATM management servers, SWIFT operator workstations, and Oracle database servers from compromised employee endpoints. Microsoft's Enterprise Access Model prevents standard endpoints and their credentials from having any path to Tier 0 financial assets. Network segmentation and privileged access workstations limit the lateral movement surface after a standard endpoint is compromised.

    Path: Implement Microsoft's Enterprise Access Model. Segment financial system management networks. Require dedicated jump hosts with MFA for access to ATM management systems, banking databases, and SWIFT operator interfaces.

Primary references

Source material this page is built on. Last reviewed against MITRE, DOJ, Europol, Kaspersky, and Mandiant reporting through July 2026.

Detect Carbanak tradecraft before it reaches your financial systems.

Malware Protection Plus catches the behavioral patterns that signature-based tools miss.

Start free trial →