FORENSIA

THREAT_ACTOR · G0008

Carbanak

Also known as: Carbanak, Anunak

Profile

Carbanak is a cybercriminal group that has used Carbanak malware to target financial institutions since at least 2013. Carbanak may be linked to groups tracked separately as Cobalt Group and FIN7 that have also used Carbanak malware.

MITRE ATT&CK ↗

Techniques

9 ATT&CK techniques attributed to this actor.

T1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1078 Valid AccountsT1102.002 Bidirectional CommunicationT1218.011 Rundll32T1219 Remote Access ToolsT1543.003 Windows ServiceT1588.002 ToolT1686 Disable or Modify System Firewall

Software

4 malware/tools attributed to this actor.

MimikatzPsExecCarbanaknetsh

Related corpus activity

3,119 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Carbanak.

IndicatorTypeFamilySevSrc
cve-2025-34117cve—851
cve-2025-34037cve—851
cve-2025-34054cve—854
cve-2020-17456cve—851
cve-2026-0740cve—851
cve-2017-17215cve—852
cve-2026-22584cve—852
cve-2016-15047cve—854
cve-2014-2321cve—851
cve-2021-4045cve—851
cve-2013-7471cve—851
cve-2026-1969cve—851
cve-2025-34085cve—851
cve-2025-7852cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2025-23304cve—852
cve-2025-68670cve—852
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2026-3102cve—853
cve-2023-44976cveransomware852
cve-2026-4368cveransomware851
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2021-29441cve—851
cve-2026-3844cve—851
cve-2025-12057cve—851
cve-2025-7443cve—851
cve-2026-5815cve—851

Showing the top 30 by severity of 3,119.