Carbanak

Source: Wikipedia, the free encyclopedia.

Carbanak is an

cyber security company Kaspersky Lab.[3] It utilizes malware that is introduced into systems running Microsoft Windows[4] using phishing emails,[3][5] which is then used to steal money from banks via macros in documents. The hacker
group is said to have stolen over 900 million dollars, from the banks as well as from over a thousand private customers.

The criminals were able to manipulate their access to the respective banking networks in order to steal the money in a variety of ways. In some instances,

SWIFT network to the criminals’ accounts, Kaspersky said. The Carbanak group went so far as to alter databases and pump up balances on existing accounts and pocketing the difference unbeknownst to the user whose original balance is still intact.[6]

Their intended targets were primarily in Russia, followed by the United States, Germany, China and Ukraine, according to Kaspersky Lab. One bank lost $7.3 million when its ATMs were programmed to spew cash at certain times that

henchmen
would then collect, while a separate firm had $10 million taken via its online platform.

Kaspersky Lab is helping to assist in investigations and countermeasures that disrupt

cybercriminal activity. During the investigations they provide technical expertise such as analyzing infection vectors, malicious programs, supported command and control infrastructure and exploitation methods.[7]

spear phishing campaign.[8] Proofpoint also published research linking the group to the Bateleur backdoor, and expanded the list of targets to U.S.-based chain restaurants, hospitality organizations, retailers, merchant services, suppliers and others beyond their initial financial services focus.[9]

On 26 October 2020, PRODAFT (Switzerland) started publishing internal details of the Fin7/Carbanak group and tools they use during their operation.[10] Published information is claimed to be originated from a single OPSEC failure on the threat actor's side.[11]

On March 26, 2018,

cybersecurity companies. The group's campaigns appear to have continued, however, with the Hudson's Bay Company breach using point of sale malware in 2018 being attributed to the group.[12]

Controversy

Some controversy exists around the Carbanak attacks, as they were seemingly described several months earlier in a report by the Internet security companies

Point of Sale systems.[15]

FBI and USSS (United States Secret Service) claiming they have not received any reports that Carbanak has affected the financial sector.[16] Two representative groups of the US banking industry FS-ISAC and ABA (American Bankers Association) in an interview with Bank Technology News say no US banks have been affected.[17]

References
  1. ^ Kaspersky Labs' Global Research & Analysis Team (GReAT) (February 16, 2015). "The Great Bank Robbery: the Carbanak APT". Securelist. Archived from the original on February 17, 2015.
  2. ^ "Carbanak_APT Analysis" (PDF). Kaspersky. Archived from the original (PDF) on 19 March 2017. Retrieved 12 June 2017.
  3. ^ a b David E. Sanger and Nicole Perlroth (14 February 2015). "Bank Hackers Steal Millions via Malware". The New York Times.
  4. ^ CARBANAK Week Part One: A Rare Occurrence FireEye, 2019
  5. ^ Fingas, Jon (February 14, 2015). "Subtle malware lets hackers swipe over $300 million from banks". engadget. Archived from the original on February 15, 2015.
  6. ^ "Carbanak Ring Steals $1 Billion from Banks". Threatpost. 15 February 2015.
  7. ^ "The Great Bank Robbery: the Carbanak APT". Securelist. 16 February 2015.
  8. ^ "FIN7 Evolution and the Phishing LNK". FireEye.
  9. ^ "FIN7/Carbanak threat actor unleashes Bateleur JScript backdoor | Proofpoint US". www.proofpoint.com. July 31, 2017.
  10. ^ "OpBlueRaven: Unveiling Fin7/Carbanak - Part I : Tirion". Prodaft.com.
  11. ^ "OpBlueRaven: Unveiling Fin7/Carbanak - Part II : BadUSB Attacks". PRODAFT.
  12. ^ Newman, Lily Hay. "THE BILLION-DOLLAR HACKING GROUP BEHIND A STRING OF BIG BREACHES". Wired.
  13. ^ "Anunak APT against Financial institutions" (PDF). Fox-IT. 22 December 2014. Archived from the original (PDF) on 22 March 2015. Retrieved 4 March 2015.
  14. ^ "Anunak aka Carbanak update". Fox-IT. 16 February 2015.
  15. ^ "Group-IB and Kaspersky have conflicting views". Kommersant. 23 February 2015.
  16. ^ "FBI, Secret service, no signs of Carbanak". Reuters. 18 February 2015. Archived from the original on 24 September 2015. Retrieved 30 June 2017.
  17. ^ "Carbanak overhyped, no US banks hit". BankTechnologyNews. 19 February 2015.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Carbanak&oldid=1142295551"