Carbanak
Software · ATTACK:enterprise:S0030
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0030",
"title": "Carbanak",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0030",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--72f54d66-675d-4587-9bd3-4ed09f9522e4",
"external_id": "S0030",
"domain": "enterprise",
"created": "2017-05-31T21:32:22.213Z",
"modified": "2025-04-16T20:38:16.838Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Carbanak"
},
{
"source_name": "Anunak"
},
{
"source_name": "FireEye CARBANAK June 2017",
"url": "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"
},
{
"source_name": "Kaspersky Carbanak",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"
},
{
"source_name": "Fox-It Anunak Feb 2015",
"url": "https://www.fox-it.com/en/news/blog/anunak-aka-carbanak-update/"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13910722-9dc6-499f-9fbf-0a9cb3daab11
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16d5d573-60bb-402c-88c3-2bc0af8388eb
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--210f5206-8763-48ac-a4c3-a08440892b5d
Kaspersky CarbanakATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a217a5a-b6c4-47c5-822a-5b278385c811
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b310a47-e010-4984-afcb-52d9c8c7933a
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54847cda-c38f-4a5b-8328-d0e6812b837b
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1055.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5950182b-4e27-4d5e-87bb-c8598314622c
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1114.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64e3196b-50c6-47d9-8841-1b7902a1546a
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a09f442-6a2a-455a-ad8d-6aa192995de3
FireEye CARBANAK June 2017ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0030
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7577e14c-ceba-4646-98ce-41e7fa9ae851
BlackBerry_FIN7_April2024 · Mandiant FIN7 Apr 2022 · FireEye FIN7 Aug 2018 · DOJ FIN7 Aug 2018 · CrowdStrike Carbon Spider August 2021 · FireEye FIN7 March 2017 · IBM Ransomware Trends September 2020 · FBI Flash FIN7 USBATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c3f8d37-e2da-45c3-8ef2-a067cd46d340
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fa238de-37c5-4224-b760-bf9f00001051
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--82384148-90fd-4bfa-a734-e9c8b37b584f
Kaspersky Carbanak · FireEye CARBANAK June 2017ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:S0030
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ab176f0-009f-49e9-ba4b-f476c33697f4
Kaspersky CarbanakATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c12e724-5f3e-4209-961e-481ec22a5ab6
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1136.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7fc5d9b-7010-4bab-9e77-3b8e449a98bd
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9bd68ed-2602-4225-838e-2d9b7f8761b4
Kaspersky Carbanak · FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0b3dc96-7adb-4d38-b3cf-b448535ffa60
FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9302591-bba1-420e-96ac-401304d37258
Kaspersky Carbanak · FireEye CARBANAK June 2017ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1030
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4182c2a-c2b3-4866-9f7e-f29e0229dead
FireEye CARBANAK June 2017