# Carbanak (Anunak)

*Financially motivated intrusion set · Active since 2013 · MITRE G0008*

## Overview

Carbanak is a cybercriminal intrusion set that has targeted financial institutions since at least 2013. MITRE ATT&CK tracks the group under [G0008](https://attack.mitre.org/groups/G0008/) with the associated name Anunak, and notes probable links to the separately tracked Cobalt Group and FIN7, both of which have used the same Carbanak backdoor. The group is also tracked as Carbon Spider, GOLD NIAGARA, Sangria Tempest (Microsoft), and ITG14.

[Europol estimated cumulative losses from the original Carbanak bank-targeting campaign at up to EUR 1 billion across more than 100 financial institutions in over 40 countries.](https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain) The campaign ran from approximately 2013 to 2018 and was distinctive for targeting banking infrastructure directly rather than individual account holders. Operators spent months recording screens and logging keystrokes to learn internal workflows before manufacturing fraudulent ATM cash disbursements, manipulating Oracle database balances, and redirecting SWIFT interbank transfers.

The group operated behind a front company, Combi Security, which recruited developers and operators under the pretense of legitimate penetration-testing work. [Three Ukrainian nationals were indicted in 2018. Fedir Hladyr was sentenced to 10 years in federal prison in April 2021. Andrii Kolpakov received 7 years and $2.5 million in restitution in June 2021.](https://www.justice.gov/opa/pr/high-level-member-hacking-group-sentenced-prison-scheme-compromised-tens-millions-debit-and) A third member, Denys Iarmak, was sentenced in 2022. The enterprise did not stop after those convictions.

Since approximately 2020, the FIN7 cluster sharing Carbanak tooling pivoted to ransomware affiliate operations, gaining privileged corporate access and deploying ransomware as the final monetization step. Microsoft tracks this phase as Sangria Tempest, documenting exploitation of Exchange ProxyShell (CVE-2021-31207) and ZeroLogon (CVE-2020-1472). The tooling also evolved: GRIFFON (VBScript stager), Bateleur (JScript backdoor with sandbox detection), and JSS Loader joined the Carbanak backdoor depending on the campaign era.

### Threat profile

**Updated:** July 29, 2026

| Field | Value |
|---|---|
| Type | Backdoor + intrusion set |
| First seen | 2013 |
| MITRE IDs | G0008 · S0030 |
| Downstream | REvil · DarkSide · BlackMatter |
| Aliases | Anunak · Carbon Spider · GOLD NIAGARA · Sangria Tempest · ITG14 |
| Motivation | Financial (theft, fraud, ransomware) |
| Delivery vectors | Spearphishing .doc/.cpl · BadUSB · CVE exploitation |
| Primary targets | Finance · retail · hospitality · POS environments |
| Key tooling | Carbanak backdoor · GRIFFON · Bateleur · JSS Loader · Cobalt Strike |
| Front company | Combi Security (disbanded 2018) |

## Operational attack chain · Carbanak / FIN7

1. **Start — Initial access**  
   Spearphishing .doc/.cpl · BadUSB · ProxyShell / ZeroLogon

2. **Stage 1 — Backdoor installed**  
   Carbanak / GRIFFON / Bateleur installs as Windows service with SYSTEM privileges

3. **Stage 2 — Weeks of reconnaissance**  
   VNC screen recording · keylogging · AdFind / csvde AD enumeration

4. **Stage 3 — Credential theft**  
   Mimikatz LSASS dump · DCSync · Kerberoasting  
   Tags: Mimikatz · DCSync · PsExec

5. **Stage 4 — Lateral movement**  
   RDP · SMB admin shares · pass the hash · AmmyyAdmin · Cobalt Strike

6. **Impact — Fraud or ransomware**  
   ATM / SWIFT manipulation · POS scraping · ransomware deployment

The initial access method varies by campaign era. Early operations used spearphishing documents; a later wave added mailed BadUSB devices; the ransomware-affiliate era added direct exploitation of Exchange and domain controllers. All paths converge on the same post-access playbook: extended reconnaissance, credential harvesting, lateral movement to high-value systems, then impact.

## Tactics, techniques, and procedures

Carbanak and FIN7 are tracked separately by MITRE ATT&CK (G0008 and G0046) because multiple threat clusters have used the Carbanak backdoor. Their technique sets overlap substantially. The coverage below draws on both groups, weighted toward post-access behaviors most relevant to defenders.

### MITRE ATT&CK coverage (summary)

| Tactic | Activity level |
|---|---|
| Recon | Not observed |
| Resource Development | Active |
| Initial Access | Heavy |
| Execution | Heavy |
| Persistence | Active |
| Privilege Escalation | Active |
| Defense Evasion | Heavy |
| Credential Access | Heavy |
| Discovery | Heavy |
| Lateral Movement | Heavy |
| Collection | Active |
| Command and Control | Active |
| Exfiltration | Active |
| Impact | Heavy |

### Technique detail — Key techniques (G0008 Carbanak / G0046 FIN7)

| Tactic | Techniques | What Carbanak does |
|---|---|---|
| Initial Access | [Spearphishing Attachment T1566.001](https://attack.mitre.org/techniques/T1566/001/) · [Replication via Removable Media T1091](https://attack.mitre.org/techniques/T1091/) · [Exploit Public-Facing App T1190](https://attack.mitre.org/techniques/T1190/) · [Valid Accounts T1078](https://attack.mitre.org/techniques/T1078/) | Early campaigns used spearphishing email with Word 97-2003 (.doc) or Control Panel Applet (.cpl) attachments exploiting CVE-2013-3906. FIN7 evolved to LNK files in ZIP archives and macro-enabled restaurant lures. A later wave mailed BadUSB devices that injected keystrokes to execute a PowerShell payload. In the ransomware-affiliate era, ProxyShell and ZeroLogon provided unauthenticated entry. |
| Execution | [Windows Command Shell T1059.003](https://attack.mitre.org/techniques/T1059/003/) · [VBScript T1059.005](https://attack.mitre.org/techniques/T1059/005/) · [Rundll32 T1218.011](https://attack.mitre.org/techniques/T1218/011/) · [Exploit for Client Execution T1203](https://attack.mitre.org/techniques/T1203/) | Attachments execute shellcode that installs the Carbanak backdoor. The VNC component loads via `rundll32.exe`. GRIFFON fingerprints hosts and retrieves payloads. Bateleur includes sandbox detection. JSS Loader uses WMI queries before beaconing C2. |
| Persistence | [Windows Service T1543.003](https://attack.mitre.org/techniques/T1543/003/) · [Registry Run Keys T1547.001](https://attack.mitre.org/techniques/T1547/001/) · [Scheduled Task T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Installs as a Windows service named after a legitimate service with binary `svchost.exe` outside System32. Scheduled tasks (e.g., `AdobeFlashSync`) re-establish C2. Registry Run keys act as fallback. |
| Privilege Escalation | [Exploit for Priv Esc T1068](https://attack.mitre.org/techniques/T1068/) · [Access Token Manipulation T1134](https://attack.mitre.org/techniques/T1134/) | ZeroLogon and ProxyShell yield elevated access. Mimikatz performs token manipulation and DCSync attacks. |
| Defense Evasion | [Match Legitimate Name T1036.005](https://attack.mitre.org/techniques/T1036/005/) · [Masquerade Task or Service T1036.004](https://attack.mitre.org/techniques/T1036/004/) · [Obfuscated Files T1027](https://attack.mitre.org/techniques/T1027/) · [File Deletion T1070.004](https://attack.mitre.org/techniques/T1070/004/) | Binary named `svchost.exe`; service name copied. JScript payloads obfuscated. GGLDR variant routes C2 through Google services. `netsh` adds firewall exceptions. |
| Credential Access | [LSASS Memory T1003.001](https://attack.mitre.org/techniques/T1003/001/) · [DCSync T1003.006](https://attack.mitre.org/techniques/T1003/006/) · [Kerberoasting T1558.003](https://attack.mitre.org/techniques/T1558/003/) · [Keylogging T1056.001](https://attack.mitre.org/techniques/T1056/001/) | Keylogging captures credentials. Mimikatz dumps LSASS and performs DCSync. Kerberoasting targets service accounts. |
| Discovery | [Domain Account Discovery T1087.002](https://attack.mitre.org/techniques/T1087/002/) · [Process Discovery T1057](https://attack.mitre.org/techniques/T1057/) · [Query Registry T1012](https://attack.mitre.org/techniques/T1012/) · [Security Software Discovery T1518.001](https://attack.mitre.org/techniques/T1518/001/) | Enumerates processes, registry, and AD accounts using AdFind and `csvde.exe`. |
| Lateral Movement | [RDP T1021.001](https://attack.mitre.org/techniques/T1021/001/) · [SMB Admin Shares T1021.002](https://attack.mitre.org/techniques/T1021/002/) · [Pass the Hash T1550.002](https://attack.mitre.org/techniques/T1550/002/) | Uses harvested credentials for RDP and SMB movement. PsExec deploys payloads. |
| Collection | [Keylogging T1056.001](https://attack.mitre.org/techniques/T1056/001/) · [Screen Capture T1113](https://attack.mitre.org/techniques/T1113/) · [Local Email Collection T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Screen capture and desktop recording to learn workflows; HTTP form grabbing and Outlook data collection. |
| Command and Control | [Web Protocols T1071.001](https://attack.mitre.org/techniques/T1071/001/) · [Web Service: Bidirectional T1102.002](https://attack.mitre.org/techniques/T1102/002/) · [Encrypted Channel T1573.001](https://attack.mitre.org/techniques/T1573/001/) | HTTP-based encrypted C2; GGLDR variant uses Google Apps Script and Sheets; remote access via AmmyyAdmin and TeamViewer. |
| Exfiltration | [Exfiltration Over C2 Channel T1041](https://attack.mitre.org/techniques/T1041/) | Keystrokes, recordings, and credentials transmitted over encrypted HTTP. |
| Impact | [Financial Extortion T1657](https://attack.mitre.org/techniques/T1657/) · [Data Encrypted for Impact T1486](https://attack.mitre.org/techniques/T1486/) | ATM/SWIFT manipulation, POS scraping (15+ million cards), and later ransomware deployments (REvil, DarkSide, BlackMatter). |

## Indicators of compromise

Durable indicators: file paths, registry keys, process patterns, and network behaviors consistent across campaigns.

### File paths & binaries

- `svchost.exe` at non-System32 path (e.g. `%ProgramData%\...`) — backdoor binary.
- `%AppData%\...\Temp\stager.vbs` — GRIFFON / Bateleur staging artifact.
- `%TEMP%\*.exe` — loader staging, often self-deleted.
- `C:\ProgramData\users.csv` — `csvde` Active Directory export.

### Registry keys

- `HKLM\...\Services\[copied service name]` — service registration.
- `HKCU\...\CurrentVersion\Run` — fallback persistence.
- `HKLM\...\TaskCache\Tasks` — scheduled task masquerade (e.g., AdobeFlashSync).
- `HKLM\...\Firewall\Rules` — `netsh` firewall exception.

### Process tree patterns

- `WINWORD.EXE → wscript.exe / mshta.exe`
- `powershell.exe -enc [base64] -w hidden`
- `svchost.exe [non-System32] → rundll32.exe [vnc_server.dll]`
- `mimikatz.exe → lsadump::dcsync / sekurlsa::logonpasswords`
- `adfind.exe / csvde.exe` outside change window

### Network behavior

- Google Apps Script / Sheets HTTPS from non-browser process
- HTTP POST with encoded payload from server assets
- Port-protocol mismatch on ports 53, 80, 443, 8080
- Large upload to consumer cloud storage from server asset

## Detection guidance

Carbanak and FIN7 rely on legitimate administrative tools and valid credentials. Behavioral correlation across process lineage, authentication logs, and network telemetry surfaces this actor reliably.

1. **Office spawning script interpreter**  
   Alert on `WINWORD.EXE`, `EXCEL.EXE`, or `OUTLOOK.EXE` spawning `wscript.exe`, `cscript.exe`, `mshta.exe`, or `powershell.exe` (especially with `-enc`).

2. **Service binary path masquerade**  
   Event ID 7045 where `svchost.exe` runs outside `C:\Windows\System32\`.

3. **DCSync from non-DC host**  
   Event ID 4662 with `DS-Replication-Get-Changes-All` from non-domain controller.

4. **LSASS memory access**  
   `PROCESS_VM_READ` handle to `lsass.exe` (Sysmon Event ID 10) or `rundll32.exe comsvcs.dll MiniDump`.

5. **Active Directory bulk enumeration**  
   Execution of `adfind.exe` or `csvde.exe` outside approved IT windows.

6. **Google Cloud connections from non-browser processes**  
   HTTPS to `script.google.com` or Google Sheets APIs from server-class systems.

## Hardening recommendations

1. **Disable Office macros from internet-sourced documents** *(Quick win)*  
   Block unsigned macros; allow only signed trusted macros.

2. **Patch Exchange and domain controllers (ProxyShell, ZeroLogon)** *(Critical)*  
   Apply Exchange CUs and Netlogon updates. Verify via CISA KEV catalog.

3. **Enable LSASS protection and restrict DCSync rights** *(Standard)*  
   Enable Credential Guard and RunAsPPL. Restrict `DS-Replication-Get-Changes-All`.

4. **Enable PowerShell script block logging and Constrained Language Mode** *(Quick win)*  
   Turn on Event ID 4104 logging; enforce via WDAC or AppLocker.

5. **Apply tiered administration and segment financial systems** *(Standard)*  
   Implement Microsoft Enterprise Access Model; require MFA and jump hosts for financial infrastructure.

Controls addressing only one stage are insufficient — layered behavioral detection across all kill-chain stages is required.

## Primary references

- [MITRE ATT&CK — Carbanak Group G0008](https://attack.mitre.org/groups/G0008/) (Apr 2025)  
- [MITRE ATT&CK — Carbanak Software S0030](https://attack.mitre.org/software/S0030/)  
- [Europol — Mastermind behind EUR 1 billion cyber bank robbery arrested in Spain](https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain) (Mar 2018)  
- [DOJ — High-Level Member of Hacking Group Sentenced to Prison (Kolpakov, 2021)](https://www.justice.gov/opa/pr/high-level-member-hacking-group-sentenced-prison-scheme-compromised-tens-millions-debit-and) (Jun 2021)  
- [Google Cloud / Mandiant — Behind the CARBANAK Backdoor](https://cloud.google.com/blog/topics/threat-intelligence/behind-the-carbanak-backdoor) (Jun 2017)  
- [Kaspersky Securelist — The Great Bank Robbery: Carbanak APT](https://securelist.com/the-great-bank-robbery-the-carbanak-apt/68732/) (Feb 2015)  
- [Proofpoint — FIN7/Carbanak Threat Actor Unleashes Bateleur JScript Backdoor](https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor) (2017)  
- [MITRE ATT&CK — Enterprise framework reference](https://attack.mitre.org/)