{ "id": "1667e3c9-692d-409f-b72b-3e992f5c67c9", "created_at": "2026-04-06T00:16:15.847415Z", "updated_at": "2026-04-10T13:11:53.414403Z", "deleted_at": null, "sha1_hash": "a1c9fcac08d8fd9cfb76080a83aa694e4d6e7b70", "title": "Two Carbanak hackers sentenced to eight years in prison in Kazakhstan", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 481574, "plain_text": "Two Carbanak hackers sentenced to eight years in prison in\r\nKazakhstan\r\nBy Catalin Cimpanu\r\nPublished: 2022-12-12 · Archived: 2026-04-05 20:29:42 UTC\r\nTwo members of the Carbanak (Cobalt) cybercrime group were sentenced today in a Kazakhstan court to eight\r\nyears in prison for stealing from Kazakhstan banks.\r\nThe sentencing was announced today by the Almaty city prosecutor's office.\r\nThe two hackers, whose names were not released, were found guilty of hacking into the IT systems of several\r\nKazakh banks between 2016 and 2017, from where they stole more than 2 billion tenges ($4.6 million).\r\nThe stolen money was sent to 250 payment cards, which were then sent to Europe, and the funds cashed out\r\nthrough ATMs across Russia, Germany, Czech Republic, Estonia, Spain, Switzerland, Slovakia, Poland, the\r\nNetherlands, Lithuania, Belgium, and France.\r\nThe hackers, which operated part of the Carbanak group, also failed in stealing 8 billion tenges ($18.6 million),\r\nprosecutors said.\r\n\"The rest of the members of this criminal organization have been identified and are on the international wanted\r\nlist,\" Kazakh officials added.\r\nThe Carbanak group was first seen operating in 2013. By 2015, the group managed to breach more than 100 banks\r\nin 40 countries around the world and stole more than $1 billion, according to a Kaspersky investigation.\r\nhttps://therecord.media/two-carbanak-hackers-sentenced-to-eight-years-in-prison-in-kazakhstan/\r\nPage 1 of 3\n\nImage: Kaspersky\r\nEtt fel inträffade.\r\nDet går inte att köra JavaScript.\r\nA first Carbanak member was arrested in March 2018 in Spain. Subsequent arrests followed in August 2018 in\r\nGermany and Ukraine (two members), and all were extradited to the US to face charges.\r\nThe suspect arrested in Germany, believed to be the gang's leader, was sentenced to 10 years in April 2021.\r\nThe suspects sentenced today in Almaty now become the 5th and 6th Carbanak members to face the music.\r\nAfter the 2018 arrests, the Carbanak group splintered into smaller groups, which continued to target the financial\r\nsector, and some also dabbled in ransomware; however, the group stopped operating as a whole at its previous\r\nhttps://therecord.media/two-carbanak-hackers-sentenced-to-eight-years-in-prison-in-kazakhstan/\r\nPage 2 of 3\n\nscale.\r\nCatalin Cimpanu\r\nis a cybersecurity reporter who previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement\r\nactions against hackers.\r\nSource: https://therecord.media/two-carbanak-hackers-sentenced-to-eight-years-in-prison-in-kazakhstan/\r\nhttps://therecord.media/two-carbanak-hackers-sentenced-to-eight-years-in-prison-in-kazakhstan/\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "origins": [ "web" ], "references": [ "https://therecord.media/two-carbanak-hackers-sentenced-to-eight-years-in-prison-in-kazakhstan/" ], "report_names": [ "two-carbanak-hackers-sentenced-to-eight-years-in-prison-in-kazakhstan" ], "threat_actors": [ { "id": "c9617bb6-45c8-495e-9759-2177e61a8e91", "created_at": "2022-10-25T15:50:23.405039Z", "updated_at": "2026-04-10T02:00:05.387643Z", "deleted_at": null, "main_name": "Carbanak", "aliases": [ "Carbanak", "Anunak" ], "source_name": "MITRE:Carbanak", "tools": [ "Carbanak", "Mimikatz", "PsExec", "netsh" ], "source_id": "MITRE", "reports": null }, { "id": "9de1979b-40fc-44dc-855d-193edda4f3b8", "created_at": "2025-08-07T02:03:24.92723Z", "updated_at": "2026-04-10T02:00:03.755516Z", "deleted_at": null, "main_name": "GOLD LOCUST", "aliases": [ "Anunak", "Carbanak", "Carbon Spider ", "FIN7 ", "Silicon " ], "source_name": "Secureworks:GOLD LOCUST", "tools": [ "Carbanak" ], "source_id": "Secureworks", "reports": null }, { "id": "610a7295-3139-4f34-8cec-b3da40add480", "created_at": "2023-01-06T13:46:38.608142Z", "updated_at": "2026-04-10T02:00:03.03764Z", "deleted_at": null, "main_name": "Cobalt", "aliases": [ "Cobalt Group", "Cobalt Gang", "GOLD KINGSWOOD", "COBALT SPIDER", "G0080", "Mule Libra" ], "source_name": "MISPGALAXY:Cobalt", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "bb8702c5-52ac-4359-8409-998a7cc3eeaf", "created_at": "2023-01-06T13:46:38.405479Z", "updated_at": "2026-04-10T02:00:02.961112Z", "deleted_at": null, "main_name": "FIN7", "aliases": [ "ATK32", "G0046", "G0008", "Sangria Tempest", "ELBRUS", "GOLD NIAGARA", "Coreid", "Carbanak", "Carbon Spider", "JokerStash", "CARBON SPIDER" ], "source_name": "MISPGALAXY:FIN7", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "ed3810b7-141a-4ed0-8a01-6a972b80458d", "created_at": "2022-10-25T16:07:23.443259Z", "updated_at": "2026-04-10T02:00:04.602946Z", "deleted_at": null, "main_name": "Carbanak", "aliases": [ "Anunak", "Carbanak", "Carbon Spider", "ELBRUS", "G0008", "Gold Waterfall", "Sangria Tempest" ], "source_name": "ETDA:Carbanak", "tools": [ "AVE_MARIA", "Agentemis", "AmmyyRAT", "Antak", "Anunak", "Ave Maria", "AveMariaRAT", "BABYMETAL", "BIRDDOG", "Backdoor Batel", "Batel", "Bateleur", "BlackMatter", "Boostwrite", "Cain \u0026 Abel", "Carbanak", "Cl0p", "Cobalt Strike", "CobaltStrike", "DNSMessenger", "DNSRat", "DNSbot", "DRIFTPIN", "DarkSide", "FOXGRABBER", "FlawedAmmyy", "HALFBAKED", "JS Flash", "KLRD", "MBR Eraser", "Mimikatz", "Nadrac", "Odinaff", "POWERPIPE", "POWERSOURCE", "PsExec", "SQLRAT", "Sekur", "Sekur RAT", "SocksBot", "SoftPerfect Network Scanner", "Spy.Agent.ORM", "TEXTMATE", "TeamViewer", "TiniMet", "TinyMet", "Toshliph", "VB Flash", "WARPRISM", "avemaria", "cobeacon" ], "source_id": "ETDA", "reports": null }, { "id": "f4f16213-7a22-4527-aecb-b964c64c2c46", "created_at": "2024-06-19T02:03:08.090932Z", "updated_at": "2026-04-10T02:00:03.6289Z", "deleted_at": null, "main_name": "GOLD NIAGARA", "aliases": [ "Calcium ", "Carbanak", "Carbon Spider ", "FIN7 ", "Navigator ", "Sangria Tempest ", "TelePort Crew " ], "source_name": "Secureworks:GOLD NIAGARA", "tools": [ "Bateleur", "Carbanak", "Cobalt Strike", "DICELOADER", "DRIFTPIN", "GGLDR", "GRIFFON", "JSSLoader", "Meterpreter", "OFFTRACK", "PILLOWMINT", "POWERTRASH", "SUPERSOFT", "TAKEOUT", "TinyMet" ], "source_id": "Secureworks", "reports": null } ], "ts_created_at": 1775434575, "ts_updated_at": 1775826713, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/a1c9fcac08d8fd9cfb76080a83aa694e4d6e7b70.pdf", "text": "https://archive.orkl.eu/a1c9fcac08d8fd9cfb76080a83aa694e4d6e7b70.txt", "img": "https://archive.orkl.eu/a1c9fcac08d8fd9cfb76080a83aa694e4d6e7b70.jpg" } }