- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Ukraine(low confidence)contested
- Motivation
- Financial crime; Financial gain
- Seen
- 2013–2026
- Status
- Active
- ATT&CK
- G0008 · 9 techniques
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0275 · carbanak
UkraineWhat it is
Carbanak is a cybercriminal group that has used Carbanak malware to target financial institutions since at least 2013. Carbanak may be linked to groups tracked separately as Cobalt Group and FIN7 that have also used Carbanak malware.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Carbon Spider
- Microsoft
- DEV-0289, Sangria Tempest
- MITRE ATT&CK
- G0008
- PwC
- White Apep
- Other names
- GOLD WATERFALL, Anunak, Carbanak, Anunak, ELBRUS
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTUkraine
- ThreatActor.info (Malpedia et al.)Russia
Targets
- Countries
- Australia, Austria, Brazil, Bulgaria, Canada, China, Czech, France, Germany, Hong Kong, Iceland, India, Luxembourg, Morocco, Nepal, Norway, Pakistan, Poland, Russia, Spain, Sweden, Switzerland, Taiwan, Ukraine, United Kingdom, United States, Uzbekistan
- Sectors
- Energy, Financial, Food and Agriculture, Healthcare, Hospitality
Tools
The tools and malware families the sources tie to it.
- Carbanak
- Cyber Eye RAT
- CyberGate
- Mimikatz
- PsExec
- Remote Utilities
- RemoteCMD
- RemotePC
- netsh
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de