Carbanak
Carbanak is a financially motivated threat actor associated with targeting banks in Russia and Ukraine since early 2014. The content notes CTU researchers assess with moderate confidence that GOLD KINGSWOOD is associated with, and may be a progression of, the group referred to as Carbanak. The actor is also referred to as Anunak in the provided aliases and reporting. The content further distinguishes Carbanak from FIN7, noting they are sometimes associated but are tracked separately. Based on the provided content, Carbanak has used a VBScript named "ggldr" that leveraged Google Apps Script, Google Sheets, and Google Forms for command and control. The group has used legitimate remote access tools including AmmyyAdmin and TeamViewer for remote interactive C2, and has obtained and used open-source tools such as PsExec and Mimikatz. The content also states Carbanak malware has a plugin for VNC and the Ammyy Admin tool. Reported defense evasion and masquerading behavior includes naming malware "svchost.exe" to imitate the Windows shared service host process. ATT&CK-related behaviors explicitly associated with Carbanak in the content include use of remote access tools, scheduled tasks/jobs, Windows services, Rundll32, and disabling or modifying the system firewall. The content also references Carbanak as one of the closest groups with similar TTPs to a bank intrusion involving PowerShell-in-registry, Meterpreter, Mimikatz, SC, and NETSH, but does not directly attribute that intrusion to Carbanak.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Banks
Where they target
Geographies tied to known operations.
- 🇷🇺 Russia
- 🇺🇦 Ukraine
Tradecraft
37 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
5 malware families attributed to this actor across reporting.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a threat actor associated with Azure Active Directory account takeover, persistence, privilege escalation, and related cloud-focused post-compromise activity detected via PowerShell module installation.
Referenced as a threat actor associated with abuse of remote management tooling for persistence and command-and-control.
Referenced as a threat actor associated with the use of remote access tools under ATT&CK technique T1219.
Referenced as a threat actor associated with use of Rundll32 for defense evasion.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.