NEW: Group Profiler — instant APT intel lookup.Try it →
Emblem illustrating the Carbanak threat group

Carbanak

G0008Financial gainMITRE ATT&CK →

Also known as:Anunak

Overview

Carbanak is a cybercriminal group that has used Carbanak malware to target financial institutions since at least 2013. Carbanak may be linked to groups tracked separately as Cobalt Group and FIN7 that have also used Carbanak malware.

Naming & attribution

Carbanak is tracked under 2 names across the industry. It uses 9 documented ATT&CK techniques — more than 26% of the 174 groups tracked here. Activity attributed since at least 2013.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
NameFirst reported by
AnunakPrins, R
CarbanakKaspersky Lab's Global Research and Analysis Team

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

Malware families with tracked indicators

One family attributed to Carbanak, with 3 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

  • Carbanak3 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

TTPs — 9 techniques across 5 tactics

Resource Development

Persistence

Stealth

Defense Impairment

Command and Control

Tools & malware (4)

Carbanak · Mimikatz · PsExec · netsh

Reporting (3)

Need the matrix overlay, mind-map, or technique-flow view? Open the interactive Group Profilerin a browser with JavaScript enabled.