The campaign was named Carbanak after investigators analyzed the malware used in the operation.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“At this point they decided to give this malware a name and they called it Carbanak.”
Campaign
campaign:carbanak
Organised bank-targeting operation associated with ATM theft, fraudulent transfers, and money-mule cash-outs.
Organised bank-targeting operation associated with ATM theft, fraudulent transfers, and money-mule cash-outs.
“These attacks on banks, they are still happening.”
“This was the first large attacks on banks and organized attacks on banks”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Carbanak | Explicit | 35 |
| outgoing | INITIAL_ACCESS_VIA | phishing | Explicit | 35 |
| outgoing | INVOLVES | exploit in patched Word vulnerability | Explicit | 35 |
| outgoing | INVOLVES | keylogging | Explicit | 35 |
| outgoing | INVOLVES | privilege escalation | Explicit | 35 |
| outgoing | INVOLVES | lateral movement | Explicit | 35 |
| outgoing | INVOLVES | screen recording | Explicit | 35 |
| outgoing | USES | Swift | Explicit | 35 |
| outgoing | INVOLVES | ATM remote access | Explicit | 35 |
| outgoing | INVOLVES | ATM jackpotting | Explicit | 35 |
| outgoing | USES | money mule | Explicit | 35 |
| outgoing | USES | Metasploit | Explicit | 35 |
| outgoing | USES | Cobalt Strike | Explicit | 35 |
| outgoing | TARGETS | Ukraine | Explicit | 35 |
| outgoing | TARGETS | Russia | Explicit | 35 |
| outgoing | ASSOCIATED_WITH | Russia | Uncertain | 35 |
| outgoing | TARGETS | Spain | Explicit | 35 |
| outgoing | TARGETS | China | Explicit | 35 |
| outgoing | ASSOCIATED_WITH | Europol | Attributed | 35 |
| outgoing | ASSOCIATED_WITH | Dutch police | Explicit | 35 |
| outgoing | ASSOCIATED_WITH | FBI | Explicit | 35 |
The campaign was named Carbanak after investigators analyzed the malware used in the operation.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“At this point they decided to give this malware a name and they called it Carbanak.”
Carbanak INITIAL_ACCESS_VIA phishing
The campaign initially entered a bank through a phishing email sent to an employee.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“They send a spare phishing e-mail to an employee at the bank”
Carbanak INVOLVES exploit in patched Word vulnerability
The phishing Word document contained an exploit for a vulnerability that had already been patched.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“that Word document contained an exploit for an already patched vulnerability”
Carbanak INVOLVES keylogging
The attackers installed a keylogger to capture administrator passwords and other keystrokes.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“The hackers first installed a key logger on this person’s computer to record every keystroke”
Carbanak INVOLVES privilege escalation
The attackers attempted to elevate privileges by obtaining administrator passwords.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“the next goal would be to elevate their privileges and get access to the domain controller”
Carbanak INVOLVES lateral movement
After obtaining one administrator password, the attackers reused it on other servers and reached the domain controller.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“Now that they have the admin password to one of the computers they’ll try to use that password on another server.”
Carbanak INVOLVES screen recording
The attackers recorded an employee's screen to learn how the bank's IT and money-transfer systems worked.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“install video recording software on the machine of one of the employees”
One cash-out method was entering data directly into the Swift system to transfer money overseas.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“One way was to enter data directly into the Swift system and transfer money overseas.”
Carbanak INVOLVES ATM remote access
The attackers remotely controlled ATMs through an ATM administration server.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“One other way was to control the ATMs remotely like we saw with the first case.”
Carbanak INVOLVES ATM jackpotting
The attackers used remote ATM administration to dump all the bills from ATMs.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“they just started dumping all the bills out”
Carbanak USES money mule
The attackers created accounts and debit cards for money mules to withdraw stolen funds.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“They created all these accounts for their money mules.”
Carbanak USES Metasploit
After Carbanak signatures became known, the attackers switched to the off-the-shelf tool Metasploit.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“they started using off-the-shelf tools such as Metasploit and Cobalt Strike”
Carbanak USES Cobalt Strike
After Carbanak signatures became known, the attackers switched to the off-the-shelf tool Cobalt Strike.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“they started using off-the-shelf tools such as Metasploit and Cobalt Strike”
The episode says most bank robberies associated with the group occurred in Ukraine and Russia.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“most bank robberies occurred in Ukraine and Russia”
The episode says most bank robberies associated with the group occurred in Ukraine and Russia.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“most bank robberies occurred in Ukraine and Russia”
The campaign later branched out to countries including Spain.
Explicit Confidence 96% · Jack Rhysider EP 35 Details
“it did start to branch out to various other countries like Spain and China”
The campaign later branched out to countries including China.
Explicit Confidence 96% · Jack Rhysider EP 35 Details
“it did start to branch out to various other countries like Spain and China”
Carbanak ASSOCIATED_WITH Europol
Europol tracked the group and reported a substantially higher estimate of the number of banks attacked and money stolen.
Attributed Confidence 99% · Jack Rhysider EP 35 Details
“Europol was also tracking this group and they had completely different numbers.”
Carbanak ASSOCIATED_WITH Dutch police
The Dutch police worked with Kaspersky researchers and seized a command-and-control server connected to the operation.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“we also decided to work on this case together with the Dutch police”
The FBI had a case on the group and shared information with other investigators.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“even the FBI had cases on this group and were sharing information”
Carbanak ASSOCIATED_WITH Russia
The episode presents the operators as Russian hackers or people fluent in Russian, so the Russian association is not certain.
Uncertain Confidence 84% · Jack Rhysider EP 35 Details
“Russian hackers or someone fluent in Russian found their way into a Russian bank’s network”