Carbanak

Profile narrative

Carbanak is an alias used to refer to a cybercrime operation that has been identified in multiple security reports as being known for financial malware attacks. The name appears in connection with ransomware groups such as Darkside, which was linked to the Carbanak operation in a 2021 incident involving One Call Insurance. Additionally, Carbanak is recognized as a backdoor payload that has been delivered by the FIN7 hacking group against targets in the financial sector.

The operation’s strategic objective is explicitly described as financially motivated, with its malware designed to facilitate monetary gain through the compromise of financial instruments and related data. Targeting has been observed in environments such as ATM manufacturers, where the Carbanak backdoor was deployed, and in insurance companies that suffered ransomware attacks attributed to groups associated with the Carbanak operation. These incidents indicate a focus on entities that process payments, manage customer financial information, or operate within the broader financial services ecosystem.

Technical details associated with Carbanak include the use of a backdoor that is injected directly into memory without touching the file system, a technique facilitated by the BOOSTWRITE loader employed by FIN7. Once installed, the Carbanak backdoor works in tandem with the RDFSNIFFER module, which hijacks legitimate remote administration software to enable command injection, file manipulation, and man‑in‑the‑middle attacks through compromised authentication sessions. This combination allows attackers to maintain stealthy control over victim systems while executing further malicious actions.

Attribution information publicly available ties the Carbanak backdoor to the FIN7 threat actor, which delivered it via the BOOSTWRITE loader in the ATM manufacturer intrusion. The Darkside ransomware gang has also been linked to the Carbanak cybercrime operation in open source reporting, suggesting a cooperative or overlapping relationship between these groups. While the Cobalt Group is noted in the same source material for historically targeting SWIFT and ATM infrastructures, no explicit statement connects Cobalt Group directly to the Carbanak alias.

Representative operations that illustrate the Carbanak methodology include the FIN7‑led intrusion against an ATM manufacturer where the BOOSTWRITE loader deposited the Carbanak backdoor and RDFSNIFFER module, enabling persistent remote access and data interception. Another example is the Darkside ransomware attack on One Call Insurance, which was publicly described as being linked to the Carbanak cybercrime operation known for financial malware attacks, highlighting the operation’s role in enabling financially driven extortion campaigns. These cases demonstrate the operation’s reliance on memory‑resident malware, legitimate software hijacking, and a clear focus on monetary profit.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 232 sources.