{ "id": "2a93eacf-9b87-4534-a9ff-3a110b9c3bbe", "created_at": "2026-04-06T00:11:37.185505Z", "updated_at": "2026-04-10T13:13:00.719974Z", "deleted_at": null, "sha1_hash": "37fc33bec9c995f0b3ed0dccd0e3abee344fb9b7", "title": "Threat Group Cards: A Threat Actor Encyclopedia", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 55244, "plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 12:45:03 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Carbanak\r\n Tool: Carbanak\r\nNames\r\nCarbanak\r\nAnunak\r\nSekur\r\nSekur RAT\r\nCategory Malware\r\nType Reconnaissance, Backdoor\r\nDescription\r\n(Kaspersky) Carbanak is a backdoor used by the attackers to compromise the victim's\r\nmachine once the exploit, either in the spear phishing email or exploit kit, successfully\r\nexecutes its payload. This section provides a functional analysis of Carbanak’s\r\ncapabilities.\r\nCarbanak copies itself into “%system32%\\com” with the name “svchost.exe” with the\r\nfile attributes: system, hidden and read-only. The original file created by the exploit\r\npayload is then deleted.\r\nTo ensure that Carbanak has autorun privileges the malware creates a new service. The\r\nnaming syntax is “\r\nSys” where ServiceName is any existing service randomly chosen, with the first\r\ncharacter deleted. For example, if the existing service ́s name is “aspnet” and the visible\r\nname is “Asp.net state service”, the service created by the malware would be\r\n“aspnetSys” with a visible name of “Sp.net state service”.\r\nBefore creating the malicious service, Carbanak determines if either the avp.exe or\r\navpui.exe processes (components of Kaspersky Internet Security) is running. If found on\r\nthe target system, Carbanak will try to exploit a known vulnerability in Windows XP,\r\nWindows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 8,\r\nand Windows Server 2012, CVE-2013-3660, for local privilege escalation. We believe\r\nthis is not relevant and that the attackers adapt their tools to the victim ́s defenses.\r\nInformation \u003chttps://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf\u003e\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d4ee0ad6-9ba5-48cb-a289-f29476852d0e\r\nPage 1 of 2\n\nMITRE ATT\u0026CK Malpedia Last change to this tool card: 16 January 2024\nDownload this tool card in JSON format\nAll groups using tool Carbanak\nChanged Name Country Observed\nAPT groups\n Carbanak, Anunak 2013-Apr 2023\n FIN7 2013-Jul 2024\n2 groups listed (2 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d4ee0ad6-9ba5-48cb-a289-f29476852d0e\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d4ee0ad6-9ba5-48cb-a289-f29476852d0e\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d4ee0ad6-9ba5-48cb-a289-f29476852d0e" ], "report_names": [ "listgroups.cgi?u=d4ee0ad6-9ba5-48cb-a289-f29476852d0e" ], "threat_actors": [ { "id": "c9617bb6-45c8-495e-9759-2177e61a8e91", "created_at": "2022-10-25T15:50:23.405039Z", "updated_at": "2026-04-10T02:00:05.387643Z", "deleted_at": null, "main_name": "Carbanak", "aliases": [ "Carbanak", "Anunak" ], "source_name": "MITRE:Carbanak", "tools": [ "Carbanak", "Mimikatz", "PsExec", "netsh" ], "source_id": "MITRE", "reports": null }, { "id": "9de1979b-40fc-44dc-855d-193edda4f3b8", "created_at": "2025-08-07T02:03:24.92723Z", "updated_at": "2026-04-10T02:00:03.755516Z", "deleted_at": null, "main_name": "GOLD LOCUST", "aliases": [ "Anunak", "Carbanak", "Carbon Spider ", "FIN7 ", "Silicon " ], "source_name": "Secureworks:GOLD LOCUST", "tools": [ "Carbanak" ], "source_id": "Secureworks", "reports": null }, { "id": "bb8702c5-52ac-4359-8409-998a7cc3eeaf", "created_at": "2023-01-06T13:46:38.405479Z", "updated_at": "2026-04-10T02:00:02.961112Z", "deleted_at": null, "main_name": "FIN7", "aliases": [ "ATK32", "G0046", "G0008", "Sangria Tempest", "ELBRUS", "GOLD NIAGARA", "Coreid", "Carbanak", "Carbon Spider", "JokerStash", "CARBON SPIDER" ], "source_name": "MISPGALAXY:FIN7", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "ed3810b7-141a-4ed0-8a01-6a972b80458d", "created_at": "2022-10-25T16:07:23.443259Z", "updated_at": "2026-04-10T02:00:04.602946Z", "deleted_at": null, "main_name": "Carbanak", "aliases": [ "Anunak", "Carbanak", "Carbon Spider", "ELBRUS", "G0008", "Gold Waterfall", "Sangria Tempest" ], "source_name": "ETDA:Carbanak", "tools": [ "AVE_MARIA", "Agentemis", "AmmyyRAT", "Antak", "Anunak", "Ave Maria", "AveMariaRAT", "BABYMETAL", "BIRDDOG", "Backdoor Batel", "Batel", "Bateleur", "BlackMatter", "Boostwrite", "Cain \u0026 Abel", "Carbanak", "Cl0p", "Cobalt Strike", "CobaltStrike", "DNSMessenger", "DNSRat", "DNSbot", "DRIFTPIN", "DarkSide", "FOXGRABBER", "FlawedAmmyy", "HALFBAKED", "JS Flash", "KLRD", "MBR Eraser", "Mimikatz", "Nadrac", "Odinaff", "POWERPIPE", "POWERSOURCE", "PsExec", "SQLRAT", "Sekur", "Sekur RAT", "SocksBot", "SoftPerfect Network Scanner", "Spy.Agent.ORM", "TEXTMATE", "TeamViewer", "TiniMet", "TinyMet", "Toshliph", "VB Flash", "WARPRISM", "avemaria", "cobeacon" ], "source_id": "ETDA", "reports": null }, { "id": "f4f16213-7a22-4527-aecb-b964c64c2c46", "created_at": "2024-06-19T02:03:08.090932Z", "updated_at": "2026-04-10T02:00:03.6289Z", "deleted_at": null, "main_name": "GOLD NIAGARA", "aliases": [ "Calcium ", "Carbanak", "Carbon Spider ", "FIN7 ", "Navigator ", "Sangria Tempest ", "TelePort Crew " ], "source_name": "Secureworks:GOLD NIAGARA", "tools": [ "Bateleur", "Carbanak", "Cobalt Strike", "DICELOADER", "DRIFTPIN", "GGLDR", "GRIFFON", "JSSLoader", "Meterpreter", "OFFTRACK", "PILLOWMINT", "POWERTRASH", "SUPERSOFT", "TAKEOUT", "TinyMet" ], "source_id": "Secureworks", "reports": null }, { "id": "bfded1cf-be73-44f9-a391-0751c9996f9a", "created_at": "2022-10-25T15:50:23.337107Z", "updated_at": "2026-04-10T02:00:05.252413Z", "deleted_at": null, "main_name": "FIN7", "aliases": [ "FIN7", "GOLD NIAGARA", "ITG14", "Carbon Spider", "ELBRUS", "Sangria Tempest" ], "source_name": "MITRE:FIN7", "tools": [ "Mimikatz", "AdFind", "JSS Loader", "HALFBAKED", "REvil", "PowerSploit", "CrackMapExec", "Carbanak", "Pillowmint", "Cobalt Strike", "POWERSOURCE", "RDFSNIFFER", "SQLRat", "Lizar", "TEXTMATE", "BOOSTWRITE" ], "source_id": "MITRE", "reports": null }, { "id": "d85adfe3-e1c3-40b0-b8bb-d1bacadc4d82", "created_at": "2022-10-25T16:07:23.619566Z", "updated_at": "2026-04-10T02:00:04.690061Z", "deleted_at": null, "main_name": "FIN7", "aliases": [ "APT-C-11", "ATK 32", "G0046", "Gold Niagara", "GrayAlpha", "ITG14", "TAG-CR1" ], "source_name": "ETDA:FIN7", "tools": [ "7Logger", "Agentemis", "Anubis Backdoor", "Anunak", "Astra", "BIOLOAD", "BIRDWATCH", "Bateleur", "Boostwrite", "CROWVIEW", "Carbanak", "Cobalt Strike", "CobaltStrike", "DICELOADER", "DNSMessenger", "FOWLGAZE", "HALFBAKED", "JSSLoader", "KillACK", "LOADOUT", "Lizar", "Meterpreter", "Mimikatz", "NetSupport", "NetSupport Manager", "NetSupport Manager RAT", "NetSupport RAT", "NetSupportManager RAT", "POWERPLANT", "POWERSOURCE", "RDFSNIFFER", "Ragnar Loader", "SQLRAT", "Sardonic", "Sekur", "Sekur RAT", "TEXTMATE", "Tirion", "VB Flash", "cobeacon" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434297, "ts_updated_at": 1775826780, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/37fc33bec9c995f0b3ed0dccd0e3abee344fb9b7.pdf", "text": "https://archive.orkl.eu/37fc33bec9c995f0b3ed0dccd0e3abee344fb9b7.txt", "img": "https://archive.orkl.eu/37fc33bec9c995f0b3ed0dccd0e3abee344fb9b7.jpg" } }