Anunak and Carbanak: A Billion-Dollar Heist
The crew that stopped robbing bank customers and learned to rob the bank itself.
- Financial Sector
Bottom line. Carbanak (first tracked as Anunak) rewrote the economics of bank fraud: instead of phishing customers, the group compromised the banks’ own operators, learned exactly how money moved, and then made ATMs, transfers and account balances do its bidding, an estimated loss of up to one billion dollars. The enduring lesson for defenders is that the most dangerous activity looks legitimate. Hunt for insider-like behaviour on money-movement systems, not just malware signatures, and treat this as current, because the Carbanak backdoor resurfaced in 2024-2025 via modern loaders.
Background
The story starts around 2013 with a campaign researchers named Anunak, hitting banks and payment processors in Russia and Eastern Europe. In early 2015 a broader, more capable variant was documented under the name Carbanak, and by late 2016 the same lineage evolved again into the toolkit tracked as Cobalt. Across those years the group targeted banks, e-payment systems and financial institutions in more than 40 countries, with cumulative losses to the industry estimated at up to one billion dollars across 100-plus institutions.
What set the group apart was not a single clever exploit but a business model. They were financially motivated, disciplined and patient, treating a bank intrusion like an internal project: get in quietly, understand the target’s specific procedures, and only then convert access into cash. In March 2018, European law enforcement announced the arrest in Alicante, Spain, of the alleged mastermind behind the Carbanak and Cobalt operations, but the tooling and tradecraft long outlived that arrest.
What we observed
The heist worked in four unhurried phases:
- Get in through a person, not a firewall: targeted spearphishing emails to bank employees carried weaponised Office documents that exploited known vulnerabilities and installed the Carbanak backdoor, a remote-access trojan built in part on leaked Carberp code, capable of keylogging, screenshots, screen-video recording and remote control.
- Learn the bank from the inside: rather than cashing out immediately, operators lurked for weeks or months, recording video of employees’ screens to learn each institution’s exact money-movement procedures, approvals and timing. They effectively trained themselves to act like trusted insiders.
- Turn access into cash three ways: (1) ATM jackpotting, commanding cash machines to dispense at a pre-arranged time to money mules waiting at the terminal; (2) fraudulent transfers, pushing funds through interbank and e-payment systems into accounts they controlled; and (3) database manipulation, inflating a legitimate account’s balance, then quietly withdrawing the fabricated difference.
- Do it at scale, quietly: because each step mimicked normal banking operations, individual actions rarely tripped fraud controls. The damage accumulated across many banks and many countries before the pattern was understood.
- The story didn’t end with the arrest: the Carbanak backdoor has re-emerged in 2024-2025, delivered through modern loader families (IDATLoader / HijackLoader), a reminder that successful criminal tooling gets reused, repackaged and resold long after its original operators are gone.
How the billion-dollar heist worked
Every step was designed to look like normal banking. The malware got them in; patience and mimicry did the theft.
Attribution
Anunak and Carbanak are two research names for the same criminal lineage, which later evolved into Cobalt and shares tradecraft and tooling overlap with the broader Carbanak/FIN7 cluster. The group was financially motivated with no state alignment established; European law enforcement attributed the operation to an organised syndicate and arrested its alleged leader in Spain in 2018. As with any long-running criminal brand, the name now covers both the original crew and the reused malware, so modern Carbanak-backdoor activity should be treated as tooling reuse rather than proof the original operators are back.
Confidence: 90%.
Carbanak didn’t steal from bank customers. It learned to be the bank, then told the ATMs to pay out.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Initial Access | Phishing: Spearphishing Attachment | T1566.001 | Bank employees were sent weaponised Office documents that installed the Carbanak backdoor. |
| Execution | Exploitation for Client Execution | T1203 | The lure documents exploited known Office vulnerabilities to run code on the operator’s machine. |
| Collection | Video Capture | T1125 | Operators recorded video of employees’ screens to learn each bank’s internal procedures. |
| Collection | Input Capture: Keylogging | T1056.001 | The Carbanak backdoor logged keystrokes to harvest credentials and workflow detail. |
| Lateral Movement | Remote Services | T1021 | The group moved laterally to reach payment, card-processing and ATM-management systems. |
| Command and Control | Application Layer Protocol: Web Protocols | T1071.001 | The backdoor communicated with its C2 over HTTP for tasking and exfiltration. |
| Impact | Financial Theft | T1657 | ATM jackpotting, fraudulent interbank transfers and inflated account balances converted access into cash. |
Detection
Copy-ready hunting query:
# Behavioural hunts inspired by the Carbanak playbook (bank / finance environments)
# 1) Office spawning script/remote-control tooling (initial foothold)
index=edr parent_process IN ("winword.exe","excel.exe","outlook.exe") process_name IN ("powershell.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe")
# 2) Screen/video capture or hidden remote control on operator workstations
index=edr (process_name IN ("*vnc*","*tightvnc*","*ammyy*") OR command_line="*screen*record*" OR api IN ("BitBlt","CreateCompatibleBitmap"))
# 3) Anomalous access to money-movement systems (SWIFT / card / ATM mgmt) off-hours or from new hosts
# Alert on first-time or after-hours logons to payment-processing and ATM-management servers.
# 4) Modern Carbanak delivery: IDATLoader / HijackLoader chains
index=edr (command_line="*mshta*" AND command_line="*http*") OR (process_name="rundll32.exe" AND command_line="*ProgramData*")
# 5) Transaction-side analytics: balance adjustments immediately followed by withdrawal/transfer of the delta.Recommendations
- Hunt for legitimate-looking anomalies, not just malware: the Carbanak signature was insider-like behaviour, after-hours access to payment/ATM-management systems, screen-recording or hidden VNC on operator workstations, and balance adjustments paired with matching withdrawals. Build detections around behaviour, not signatures.
- Segment and gate the money: isolate SWIFT, card-processing and ATM-management systems, enforce MFA and least privilege, require multi-person approval for high-value or database-level changes, and monitor those systems as crown jewels.
- Close the entry point: block or restrict Office macros and patch client software, and give finance and operations staff targeted phishing training. They are the door the group walked through.
- Treat it as current: the Carbanak backdoor is back in 2024-2025 via IDATLoader / HijackLoader, so hunt for those loader chains and keep loader/backdoor indicators from your feeds current.
- Assume patience: long dwell time was the whole strategy. Hunt for established footholds and slow, low-volume reconnaissance, not just noisy initial infections, and rehearse an incident response that assumes the adversary already understands your processes.
