Carbanak is a cybercriminal group that has used Carbanak malware to target financial institutions since at least 2013. Carbanak may be linked to groups tracked separately as Cobalt Group and FIN7 that have also used Carbanak malware.12345
- Kaspersky Carbanak
- FireEye FIN7 April 2017
- Europol Cobalt Mar 2018
- Secureworks GOLD NIAGARA Threat Profile
- Secureworks GOLD KINGSWOOD Threat Profile
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Carbanak | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Anunak | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1036.004 | Masquerade Task or Service | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1078 | Valid Accounts | — |
| T1102.002 | Bidirectional Communication | — |
| T1218.011 | Rundll32 | — |
| T1219 | Remote Access Tools | — |
| T1543.003 | Windows Service | — |
| T1588.002 | Tool | — |
| T1686 | Disable or Modify System Firewall | — |
Aliases
Anunak · Carbanak
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.