Malware Spotlight: Carbanak

The source code for banking malware APT Carbanak was discovered in the archives of VirusTotal. Researchers found the source code was uploaded over two years ago and contains the source code, plugins and builders that the hackers used to create the malware. The malware authors used it to: transfer money to attacker controlled accounts, inflate account balances, control ATMs and disperse money, and transfer money between banks in China and the US. Carbanak has been very successful for the hackers that employed it and the malware enabled the attackers to steal over one billion euros over the past six years.

Recommendations

• Enable the cyber attack chatter rule in the ZeroFOX platform to monitor for information indicating targeting of your enterprise.
• VirusTotal Links to the leaked malware: source code part 1, source code part 2

Details

The source code to a popular banking APT was discovered by security researchers. Carbanak, a full featured piece of malware which targets banking systems, was found by security researchers at VirusTotal. The researchers uncovered archived versions of the code which were uploaded to VirusTotal’s malware engine a couple of years ago. Carbanak has been very successful for the hackers that employed it and the malware enabled the attackers to steal over one billion euros over the past six years.

In order to gain access to the banking systems, targets at the bank were spear phished and encouraged to open the Carbanak malware. The attackers used Carbanak to progressively gain an increased foothold on the banking systems until they gained administrative access. Once administrative access was gained, they used the malware to: transfer money to attacker controlled accounts, inflate account balances, control ATMs and disperse money, and transfer money between banks in China and the US. Carbanak is one of the most successful and dangerous banking APTs.