Carbanak
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 3 incidents
- Sources
- 21 sources
- First seen
- 2016-07-25
- Last seen
- 2018-03-28
- Updated
- 2026-10-14 19:50
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor known as Navistar, Carbanak, Carbanak Gang (also tracked as Fin7 or Cobalt) is a Russian‑based cybercriminal group financially motivated to steal payment card data and other financial assets. It primarily targets banks, retail and hospitality companies, and point‑of‑sale (POS) systems worldwide, with notable incidents including the 2018 compromise of Saks Fifth Avenue and Lord & Taylor stores that yielded over five million stolen cards, the 2016 breach of Oracle’s MICROS POS support portal affecting hundreds of systems, and the 2019 Burgerville restaurant chain intrusion that harvested customer credit‑card details. The group’s tactics involve initial access via phishing emails or exploitation of third‑party web‑server vulnerabilities, followed by deployment of loaders such as BOOSTWRITE that execute malicious payloads directly in memory, including the Carbanak backdoor and the RDFSNIFFER RAT, often after an initial Dridex infection for deeper network penetration. It also abuses legitimate remote‑administration software (e.g., NCR Aloha Command Center Client) to maintain persistence and conduct man‑in‑the‑middle attacks. Attribution to Russia is supported by multiple sources describing the actors as a Russian organized cybercrime gang, though no state sponsorship is asserted in the material.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 21 sources.