Between 2013 and 2015, a criminal group stole between $500 million and $1 billion from banks across Russia, Ukraine, Europe, the United States, and Japan. They did it not by exploiting ATMs or payment systems directly, but by compromising the internal networks of the banks themselves - becoming insiders, watching operations for months, then executing transfers that mimicked normal bank activity so closely that the theft wasn't detected until the money was already gone. The operation was called Carbanak, named after the malware used to maintain access.
The Initial Infection
Carbanak attacks typically began with spear phishing emails sent to bank employees. The emails impersonated financial regulators, banking partners, or internal IT departments, and carried Microsoft Word documents exploiting CVE-2012-0158 or similar Office vulnerabilities - buffer overflows in ActiveX controls that allowed arbitrary code execution when the document was opened.
The initial payload was a dropper that installed the Carbanak RAT - a modified version of the Carberp banking trojan with significant additions. Carbanak had full remote access capability: keylogging, screenshot capture on a timer, video recording of screen activity, clipboard monitoring, and a reverse shell. Critically, it was designed for long-term persistence rather than quick credential theft. The attackers were not after individual banking credentials. They were after operational knowledge.
The Reconnaissance Phase
After initial compromise, the Carbanak group spent two to four months in reconnaissance on each target bank before executing any theft. During this phase, they expanded their access from the initial employee's workstation to other systems - targeting banking operations staff, cash management systems, and ultimately the systems connected to interbank transfer networks.
They observed everything: how large transfers were authorized, which employees had approval authority, what the approval workflow looked like in the software interface, how many verification steps existed, and what times of day large transactions were normal versus suspicious. They took screenshots and video of operators performing legitimate large transfers, building a detailed understanding of what authorized activity looked like from an insider perspective.
This reconnaissance approach reflected a fundamental insight: the attackers' goal was not to compromise the bank's systems in a technically detectable way, but to simulate authorized insider activity so precisely that automated fraud detection would not trigger.
The Three Theft Mechanisms
Carbanak operators used three distinct methods to extract money from compromised banks, varying the approach based on which systems they could access at each target.
SWIFT transfers. In banks with access to SWIFT interbank messaging, operators would initiate transfers that mimicked legitimate cross-border transactions. The transfers went to accounts the group controlled at other banks, which would quickly withdraw cash or convert to cryptocurrency before the source bank noticed anything wrong. This was the most lucrative method, enabling individual transactions in the millions.
ATM jackpotting via remote command. Carbanak operators compromised the systems used to manage ATM networks at some banks. They pre-positioned accomplices - "money mules" - at specific ATM locations, then sent commands remotely that caused the ATMs to dispense their entire cash loads at specified times. The mules picked up the cash. The ATM would record the dispensing as an error rather than a transaction, reducing the forensic trail.
Account balance manipulation. In some cases, the attackers inflated account balances in the core banking system - changing a victim account from $1,000 to $10,000 - and had accomplices withdraw the difference. Since the balance before and after the withdrawal appeared consistent from the core banking system's perspective (the manipulation happened before the withdrawal and was reversed after), some of these thefts were not detected for extended periods.
Scale and Attribution
Kaspersky Lab published the first public report on Carbanak in February 2015, after being called in to investigate an anomalous ATM at a Russian bank that was dispensing cash without transactions. The investigation revealed the broader campaign. Kaspersky's initial estimate was $1 billion stolen from approximately 100 banks across 30 countries. Later analysis from Europol and national law enforcement adjusted these figures downward somewhat, but the operation remained the largest known bank theft in history at the time of disclosure.
Attribution involved a group sometimes called FIN7 (by Mandiant) and sometimes Cobalt Group (by Group-IB), though these designations are contested and the relationship between different threat actors associated with Carbanak-family malware is not definitively established. The group is generally assessed as criminal (financially motivated) rather than state-sponsored, with a strong Russian-speaking component. Several members were eventually arrested - one in Spain in 2018, others in Eastern Europe.
Arrest of the Alleged Ringleader
In March 2018, the alleged leader of the Carbanak group - Denis Katana Sugakov, operating under the handle "Denis K" - was arrested in Alicante, Spain in a coordinated operation involving Europol, Interpol, the US FBI, and Romanian, Moldovan, Belarusian, and Taiwanese law enforcement. Spanish police located him after tracing a luxury lifestyle (a house with an artificial indoor beach, a Golden Retriever show dog) financed by suspicious cryptocurrency transactions.
The arrest was announced with significant fanfare from Europol, though the subsequent prosecution was more complicated. Establishing the legal chain from Carbanak malware on banking systems to a specific individual's criminal liability required years of international legal process. Several co-conspirators were prosecuted in separate proceedings.
Legacy and Successor Operations
Carbanak demonstrated that APT-level capabilities - patient, long-dwell, multi-stage operations - could be applied to financial theft rather than intelligence collection. The operational template influenced subsequent financially motivated groups. The FIN7 group continued operations using Carbanak-derived tools against retail and hospitality companies, pivoting to POS system compromise and card data theft. The Cobalt Group (a related cluster) continued targeting financial institutions.
The incident also drove changes in financial sector security architecture. SWIFT's Customer Security Programme (CSP), launched after the Bangladesh Bank heist of 2016, addressed some of the gaps that Carbanak exploited - specifically, the insufficient authentication and monitoring around SWIFT terminal access. Major banking sector regulators including the Federal Reserve, ECB, and Bank of England updated examination criteria for cyber risk following the Carbanak disclosure.
What Carbanak proved, above all else, is that the most valuable attack in financial cybercrime is not a technical exploit of a payment system - it's a long-term human intelligence operation conducted through malware. The attackers who stole a billion dollars from banks did so by watching employees work for months and then impersonating them. The fraud detection systems that banks had spent billions building were designed for anomalous external transactions, not for transactions that looked exactly like legitimate internal operations.