File · Carbanak · Crime · refreshed 2026-10-18

Carbanak

Anunak

attack rose · 9 techniques across 5 tactics

Analyst brief

Carbanak is a cybercriminal group that has used Carbanak malware to target financial institutions since at least 2013. Carbanak may be linked to groups tracked separately as Cobalt Group and FIN7 that have also used Carbanak malware.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

9 techniques · 5 of 15 tactics

Matters for

Resource development
1 technique
Persistence
1 technique
Stealth
4 techniques
Defense impairment
1 technique
Command and control
2 techniques

select a technique

Arsenal

1 malware · 3 tools

Malware
Malware · 1	ATT&CK	Shared by
Carbanak	S0030 ↗	2 actors

Tools
Tools · 3	ATT&CK	Shared by
Mimikatz	S0002 ↗	51 actors
PsExec	S0029 ↗	41 actors
netsh	S0108 ↗	8 actors

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

linked, never re-hosted

Take it with you

keyless · no signup

References

7 sources

Track Carbanak on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Analyst brief

Kill chain

Resource development

Persistence

Stealth

Defense impairment

Command and control

Arsenal

Primary-source reports

Take it with you

References

Track Carbanak on the wire.