Carbanak
Carbanak is a threat group that mainly targets banks. It also refers to malware of the same name (Carbanak). It is sometimes referred to as FIN7, but these appear to be two groups using the same Carbanak malware and are therefore tracked separately. [1] [2]
Associated Group Descriptions
Name | Description |
---|---|
Anunak | |
Carbon Spider |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.[1] |
Enterprise | T1562 | .004 | Impair Defenses: Disable or Modify System Firewall |
Carbanak may use netsh to add local firewall rule exceptions.[5] |
Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
Carbanak has named malware "svchost.exe," which is the name of the Windows shared service host program.[1] |
.004 | Masquerading: Masquerade Task or Service |
Carbanak has copied legitimate service names to use for malicious services.[1] |
||
Enterprise | T1219 | Remote Access Software |
Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.[5] |
|
Enterprise | T1218 | .011 | Signed Binary Proxy Execution: Rundll32 |
Carbanak installs VNC server software that executes through rundll32.[1] |
Enterprise | T1078 | Valid Accounts |
Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.[1] |
|
Enterprise | T1102 | .002 | Web Service: Bidirectional Communication |
Carbanak has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.[6] |
Software
References
- Kaspersky Lab's Global Research and Analysis Team. (2015, February). CARBANAK APT THE GREAT BANK ROBBERY. Retrieved August 23, 2018.
- Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
- Prins, R. (2015, February 16). Anunak (aka Carbanak) Update. Retrieved January 20, 2017.
- Johnston, R. (2016, May 16). State of the Criminal Address. Retrieved December 7, 2017.
- Group-IB and Fox-IT. (2014, December). Anunak: APT against financial institutions. Retrieved April 20, 2016.
- Griffin, N. (2017, January 17). CARBANAK GROUP USES GOOGLE FOR MALWARE COMMAND-AND-CONTROL. Retrieved February 15, 2017.