Carbanak is the name given to both a sophisticated banking trojan and the criminal group that deployed it against over 100 financial institutions worldwide between 2013 and 2018. The operation stole an estimated $1 billion from banks across 30+ countries - making it one of the most financially successful cybercriminal campaigns ever documented. The methodology was distinctive: rather than targeting bank customers (the approach of Zeus and GameOver Zeus), Carbanak targeted the banks themselves, specifically the internal systems that banks use to manage ATM operations, international transfers, and account balances.

The Carbanak operation was uncovered by Kaspersky Lab, whose researchers published a landmark report in February 2015. The report described an adversary with deep knowledge of banking operations, unusual patience (attackers spent months inside bank networks before executing a theft), and a willingness to adapt their techniques to each specific bank's internal systems. The group behind Carbanak later evolved into what became known as FIN7, a financially motivated threat actor that pivoted to targeting restaurant chains, retail, and hospitality companies - with particular focus on stealing payment card data.

How Carbanak Attacked Banks

The initial infection vector was spear-phishing emails sent to bank employees. The emails contained malicious Word documents exploiting CVE-2012-0158 (a Microsoft Office buffer overflow) or other Office vulnerabilities, delivering the Carbanak backdoor. The malware established persistence and connected to command-and-control infrastructure, giving the attackers remote access to the compromised machine.

After initial compromise, the attackers spent weeks or months in reconnaissance - mapping the bank's network, identifying valuable systems, and most importantly, studying how the bank's employees actually operated their systems. The attackers used screen capture and video recording malware to watch bank employees conduct their daily work. They literally learned to use the bank's internal software by watching the people who used it every day.

This reconnaissance phase made Carbanak attacks uniquely bank-specific. The attackers weren't deploying generic bank-targeting malware; they were learning each bank's specific processes and then tailoring their theft to that bank's systems. When ready to execute a theft, they would deploy their technique and extract money in ways that mimicked legitimate bank operations.

[TECHNICAL NOTE]
Carbanak theft mechanisms - three main approaches were used across different banks: (1) ATM jackpotting via internal system access - attackers with access to the system controlling ATM cash dispensing could instruct specific ATMs to dispense cash at a prearranged time. Money mules stationed at target ATMs would collect the cash when the machine began dispensing unprompted. No card or PIN required; the attackers controlled the dispensing system directly. (2) SWIFT transfer manipulation - attackers with access to SWIFT messaging systems could create fraudulent international transfers. Unlike the Bangladesh Bank heist (which targeted SWIFT Alliance Access directly), Carbanak targets used whatever internal transfer system the bank operated. (3) Account balance manipulation - attackers would inflate a customer's account balance (from e.g., $1,000 to $10,000), allow a money mule to withdraw the inflated amount, then restore the original balance before the anomaly was detected. The account owner's real balance was unchanged; the bank's funds were debited to the mule. This technique was particularly elegant because it did not trigger fraud detection systems designed to look for large unauthorized transfers.

Scale and Geography

Kaspersky's 2015 report identified over 100 financial institutions in 30+ countries as victims. Russia was the most heavily targeted country, followed by the United States, Germany, China, and Ukraine. The geographical spread suggested a sophisticated organization with language capabilities across multiple regions - or at minimum, the operational ability to conduct attacks globally without local presence.

Individual theft amounts per bank ranged from hundreds of thousands to tens of millions of dollars. The attackers appeared to cap their withdrawals per target institution to avoid triggering investigation - taking what they calculated a bank would absorb without public disclosure. Some banks quietly absorbed losses internally; others reported to law enforcement but tried to avoid public disclosure that would damage customer confidence. This meant the actual scale of Carbanak losses was almost certainly underreported.

The $1 billion estimate came from Kaspersky's assessment across all identified victims. Independent security researchers and law enforcement sources later suggested the true total, including unreported victims, was likely higher. The scale made Carbanak the most successful bank robbery campaign in history - vastly exceeding any physical bank robbery or traditional fraud scheme.

[WARNING]
The Carbanak operation demonstrated that the most sophisticated bank theft did not target customer credentials or payment card numbers - it targeted the bank's own internal operations. Banks had invested heavily in customer-facing fraud detection: monitoring for unusual card transactions, detecting account takeover, verifying customer identities. These controls were irrelevant against an attacker who had compromised the internal systems those controls were managed from. The attackers in some cases had access to the exact systems used to review fraud alerts, allowing them to suppress or clear suspicious activity flags on their own operations. The lesson - that protecting internal bank operations required the same rigor as protecting customer-facing systems - was known before Carbanak but had been insufficiently implemented. The attacker's extended reconnaissance phase (sometimes 2-4 months of watching employees before executing theft) also showed that traditional intrusion detection based on network anomalies was insufficient when the attacker operated very slowly and mimicked legitimate user behavior.

Arrests and FIN7 Evolution

The first major arrest in the Carbanak investigation came in March 2018, when Europol, the FBI, Romanian, Belarusian, Moldovan, Taiwanese, and Spanish police cooperated to arrest Denis Katana Dubnikov and two other suspects in Alicante, Spain. The Spanish arrest was described as the head of the Carbanak group.

The US Department of Justice separately prosecuted members of FIN7 - the group that had evolved from or overlapped significantly with Carbanak and focused on restaurant and retail targets in the US. In 2018, three Ukrainian nationals were charged: Dmytro Fedorov (28), Fedir Hladyr (33), and Andrii Kopytko. Hladyr, who had served as the group's systems administrator, pleaded guilty in 2019 and cooperated with prosecutors. He was sentenced to 10 years in federal prison in 2021 - a relatively substantial sentence for cybercrime. Fedorov and Kopytko were sentenced in 2021 and 2022 respectively.

The FIN7 prosecution was unusually detailed about the group's internal organization. Hladyr's cooperation revealed that FIN7 operated with approximately 70 employees, organized into teams with specialized roles: a business development team that identified targets, a malware development team, an operations team conducting intrusions, a cash-out team coordinating money mules, and even a customer service team that handled communications with victims during ransomware negotiations (by this point the group had added ransomware to its portfolio).

[IOC]
Carbanak/FIN7 IOCs: initial access via spear-phishing with malicious Office documents, primarily exploiting CVE-2012-0158 (MSCOMCTL.OCX buffer overflow) and later CVE-2015-1641. Carbanak backdoor characteristics: persistent via Windows registry run keys; uses HTTP/HTTPS for C2 with custom protocol; supports screen capture, video recording, keylogging, remote shell, file transfer. Carbanak C2 infrastructure used compromised legitimate websites as proxies. FIN7 later shifted to Cobalt Strike as primary post-exploitation framework. FIN7 targeted POS (point-of-sale) systems in restaurant chains including Chipotle, Chili's, Arby's, Red Robin, Jason's Deli - collecting payment card track data from memory of POS systems. The group sent job application emails to restaurant companies with malicious attachments under the guise of applicant resumes. Indicators: network traffic to unusual domains over port 443 from POS systems; LSASS memory access from unexpected processes; scheduled task persistence with unusual naming; lateral movement via PsExec, WMI; CardView malware for POS memory scraping. Attribution: primarily Ukrainian nationals, operating from Eastern Europe. No confirmed state sponsorship. Key arrested members: Denis Dubnikov (Carbanak leader), Fedir Hladyr (FIN7 sys admin, 10yr sentence), Dmytro Fedorov, Andrii Kopytko.