Carbanak
IntrusionSet · ATTACK:enterprise:G0008
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0008",
"title": "Carbanak",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0008",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--55033a4d-3ffe-46b2-99b4-2c1541e9ce1c",
"external_id": "G0008",
"domain": "enterprise",
"created": "2017-05-31T21:31:49.021Z",
"modified": "2026-07-31T18:47:55.855Z",
"version": "2.0",
"aliases": [
"Carbanak",
"Anunak"
],
"tactics": [
],
"source_references": [
{
"source_name": "Carbanak"
},
{
"source_name": "Anunak"
},
{
"source_name": "Kaspersky Carbanak",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"
},
{
"source_name": "FireEye FIN7 April 2017",
"url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
},
{
"source_name": "Europol Cobalt Mar 2018",
"url": "https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain"
},
{
"source_name": "Secureworks GOLD NIAGARA Threat Profile",
"url": "https://www.secureworks.com/research/threat-profiles/gold-niagara"
},
{
"source_name": "Secureworks GOLD KINGSWOOD Threat Profile",
"url": "https://www.secureworks.com/research/threat-profiles/gold-kingswood?filter=item-financial-gain"
},
{
"source_name": "Fox-It Anunak Feb 2015",
"url": "https://www.fox-it.com/en/news/blog/anunak-aka-carbanak-update/"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28a4517c-89b9-4744-a58f-6a1f1fec3c33
Kaspersky CarbanakATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--539f8bc3-3fb4-43af-8918-9a65239cdff6
Kaspersky CarbanakATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58882b0d-0f4a-4e12-b8c1-f43c53fd96f4
Kaspersky CarbanakATTACK:enterprise:G0008 → uses → ATTACK:enterprise:S0030
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ab176f0-009f-49e9-ba4b-f476c33697f4
Kaspersky CarbanakATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a732c265-07f0-4e9b-a42c-0df6277e5b27
Forcepoint Carbanak Google C2ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aad8c4dc-db11-48b4-b294-f63ccde5e798
Kaspersky CarbanakATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af1514c0-0e58-4878-a409-9804a7ce5e0b
Group-IB AnunakATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bbf116bf-6f8a-44f4-9d98-db6ccbbff333
Kaspersky CarbanakATTACK:enterprise:G0008 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4bea2b7-e8a2-45d0-bac2-4d82576c1521
Kaspersky CarbanakATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1686
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8eec284-ab05-48a5-b79e-412db42f7123
Group-IB AnunakATTACK:enterprise:G0008 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0f797ce-9176-4b74-8d64-fad4e1bdef4f
Kaspersky CarbanakATTACK:enterprise:G0008 → uses → ATTACK:enterprise:S0108
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2e2d332-f27b-46fb-b48f-4ee1872b321f
Group-IB AnunakATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9b07e52-aff8-4fad-af72-ff646495d25f
Kaspersky Carbanak