The Patching Friars' AlmanacA calendar of CVE saints
CarbanakHoly card for d-carbanak, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 ATM Carbanak BANCOMAT PROFLUENS
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Circle VI · Banking trojans and infostealers

The Demon Carbanak, Bank Robber in Slippers

Legend

From around 2013 a criminal gang used the Carbanak backdoor to break into bank networks, record employees' screens to mimic their routines and cash out by making ATMs spit out money or through fraudulent transfers, with losses estimated up to a billion euros. Kaspersky made the campaign public in 2015. The suspected leader was arrested in Spain in March 2018 in an operation coordinated by Europol with the Spanish police and the FBI, though related FIN7 activity continued.

Exorcism

Cast it out by blocking spearphishing attachments and patching Office. In banks, watch ATMs and SWIFT systems for remote-control tools, and segment payment networks from the rest of the office.

Technical record

Also known as
Anunak
Circle
Circle VI · Banking trojans and infostealers
First seen
2013
Status
Exorcised (Arrest of Carbanak/Cobalt leader in Spain, 2018-03-26)

Backdoor malware used from about 2013 by a criminal group to infiltrate bank networks, record employees' screens, and cash out via ATMs and fraudulent transfers, with losses estimated up to a billion euros. Kaspersky exposed the campaign in 2015. The suspected leader was arrested in Spain in March 2018 in a Europol-coordinated operation.

Sources: attack.mitre.org · attack.mitre.org · europol.europa.eu · MITRE ATT&CK reference S0030

© The MITRE Corporation. ATT&CK® information is reproduced and distributed with the permission of The MITRE Corporation.

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.