Carbanak and FIN7: The $1 Billion Criminal Operation That Studied Banks From the Inside

2026-08-09-18 min read

#carbanak#fin7#anunak#banking-malware#atm-jackpotting#swift#pos-malware#kaspersky#spear-phishing#organized-crime

Between 2013 and 2018, a criminal group known by different names to different security firms - Carbanak, Anunak, FIN7, Cobalt Group - stole more than $1 billion from banks, restaurant chains, and retail companies across the US, Europe, and Asia. The group's distinguishing characteristic was patience: they would spend months inside victim networks studying operations, learning how employees worked, and preparing attacks that mimicked legitimate business processes so precisely that banks authorized fraudulent transfers without triggering fraud detection.

Carbanak's bank heist methodology was unlike anything the financial sector had previously encountered. Rather than compromising customer accounts (the standard approach), they compromised the banks themselves - getting access to internal systems that controlled ATMs, SWIFT transfers, and account balances. They then manipulated these systems directly: programming ATMs to dispense cash at specific times without any card being inserted, inflating account balances and withdrawing the inflated amount through money mules, and submitting SWIFT transfers to accounts they controlled. The operation was more sophisticated than most nation-state espionage campaigns, and it was run for profit by a criminal organization.

The Initial Access: Spear-Phishing Bank Employees

Carbanak's initial access to bank networks was almost always spear-phishing. Emails targeted bank employees - tellers, IT staff, accountants - with convincing pretexts containing malicious attachments. The malware payload was the Carbanak backdoor (named after the group), a sophisticated RAT that provided persistent access, keylogging, screenshot capture, and video recording of victim screens.

The video recording capability was central to the operation's success. After installing the Carbanak backdoor, operators would observe employee screens for weeks or months, recording how employees performed specific tasks: how they initiated wire transfers, what approval workflows looked like, who had authority to approve large transactions, what the normal pattern of ATM cash loads looked like. This intelligence allowed them to craft operations that looked exactly like normal bank operations.

The persistence phase averaged two to four months per target before any theft occurred. The group maintained access to multiple banks simultaneously, running parallel operations in different countries. Their C2 infrastructure used legitimate cloud services and CDNs to blend traffic, and they frequently rotated infrastructure to avoid detection.

[TECHNICAL NOTE]

The Carbanak malware was technically sophisticated for criminal software in 2013-2015. It supported: remote desktop control (allowing operators to see and control infected workstations), keylogging with application-aware capture (recording keystrokes with context about which application they were typed in), screenshot and video capture at configurable intervals, file transfer, command execution, and a custom protocol for C2 communication that mimicked legitimate traffic. The malware used a custom encryption scheme for C2 communications and stored configuration in an encrypted registry key. The video recording feature - capturing MPEG video of bank employee screens during work hours - was what allowed the group to understand internal bank operations well enough to carry out convincing fraud. Kaspersky's 2015 analysis of Carbanak described it as demonstrating "APT-level" sophistication - techniques normally associated with state-sponsored espionage, deployed for bank robbery.

ATM Jackpotting and Account Balance Manipulation

The most dramatic Carbanak technique was ATM jackpotting: programming ATMs to dispense cash at a specific time without any card interaction. Operators who had studied the bank's ATM management systems would issue commands to specific ATMs at a pre-arranged time, causing them to dispense their cash cartridges. Money mules stationed at the ATMs would collect the cash. The ATM would show no malfunction; from the machine's perspective, it had dispensed cash normally.

A related technique manipulated account balances. If an account contained $1,000, operators would change the balance to $10,000 in the bank's systems, withdraw $9,000 through money mule accounts (leaving the account at $1,000, apparently unchanged), and then revert the balance change. The account holder would never notice; the bank's fraud detection would not trigger because the account balance never went below zero; the money simply appeared from nothing.

For larger operations, the group used SWIFT to transfer money directly from bank accounts to accounts they controlled at banks in China and the US. This was similar to the Bangladesh Bank heist methodology - submitting legitimate-looking SWIFT transfers from inside a compromised bank network.

FIN7: Targeting Restaurants and Retail

A related cluster of the group, tracked by Mandiant as FIN7 (financial threat group 7), pivoted from banks to restaurants and retail companies. FIN7 targeted point-of-sale systems at restaurant chains including Chipotle, Arby's, Chili's, and Sonic, as well as retailers. The methodology was similar: spear-phishing restaurant employees, installing malware that scraped payment card data from POS terminal memory, and exfiltrating millions of card numbers.

FIN7's spear-phishing was notable for its quality. Emails were carefully crafted for specific targets - a catering inquiry to a restaurant with a realistic event description, a job application to an HR department with a genuine-looking resume. The group ran what amounted to a professional criminal organization: some members handled spear-phishing, others managed C2 infrastructure, others handled cashing out stolen card data. Internal chats recovered in subsequent investigations showed a hierarchical organization with management structure and performance tracking.

[WARNING]

The Carbanak/FIN7 investigation and arrests illustrated both the capabilities and limitations of law enforcement against organized cybercrime. Ukrainian authorities arrested three members in 2018 after a multi-year joint investigation with Europol, the FBI, and private sector partners (notably Kaspersky and Group-IB). The arrested individuals included operational leaders but not the full organization. FIN7 activity continued after the 2018 arrests - the group was large enough that removing several key members did not stop operations. Subsequent indictments in the US targeted Ukrainian and Russian nationals who have not been extradited. The persistent challenge with eastern European cybercrime groups is that their operational centers are in countries that do not extradite to the US and where local law enforcement cooperation is inconsistent.

Scale and Response

Kaspersky's February 2015 report on Carbanak - based on an investigation that began when a Ukrainian bank hired them to investigate a suspicious ATM - estimated that over 100 banks in 30 countries had been targeted, with total losses exceeding $1 billion across all operations. Individual bank losses ranged from $2.5 million to $10 million per target.

The report was presented at the Security Analyst Summit in 2015 and caused significant alarm in the financial sector. Banks that had assumed their internal networks were safe from account-level fraud discovered that the threat model needed to include the possibility of sustained, patient intrusion into banking operations infrastructure itself.

The banking sector's response included enhanced monitoring of internal systems, anomaly detection for bulk account changes and ATM reprogramming operations, and network segmentation improvements to limit lateral movement. SWIFT implemented its Customer Security Programme (CSP) partially in response to Carbanak and Bangladesh Bank, requiring member banks to meet minimum security standards for systems connected to SWIFT.

[IOC]

Carbanak malware indicators: Kaspersky published extensive IOCs with their February 2015 report, including C2 domains, file hashes, mutex names, and registry keys used for persistence. The malware family is detected as Backdoor.Win32.Carbanak or variants by major AV vendors. FIN7 indicators: Mandiant published multiple reports (2015-2018) documenting FIN7 TTPs and infrastructure. Network indicators included use of legitimate cloud services (Dropbox, GitHub, Pastebin) for C2 staging; behavioral indicators included process injection into legitimate banking applications, VNC-based lateral movement, and MSSQL stored procedures used for persistence. Detection: the video recording activity (creating MPEG files on victim systems) and large data staging in temp directories prior to exfiltration are behavioral indicators that UEBA/EDR systems can detect. The Carbanak/FIN7 operators' tradecraft improved significantly between 2013-2018 in response to published reports - operators changed TTPs after each public disclosure, making IOC-based detection increasingly ineffective and behavioral detection increasingly important.