{ "id": "b54f8ad1-a5d1-42db-90a8-bc2ef98eb499", "created_at": "2026-04-06T00:15:59.249183Z", "updated_at": "2026-04-10T03:37:23.845205Z", "deleted_at": null, "sha1_hash": "f5be6d41943b1acbd1ce5c55d970e900593acdf3", "title": "CARBANAK (aka ANUNAK) Distributed via IDATLOADER (aka HIJACKLOADER)", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1385734, "plain_text": "CARBANAK (aka ANUNAK) Distributed via IDATLOADER (aka\r\nHIJACKLOADER)\r\nBy Dave Truman\r\nPublished: 2024-11-18 · Archived: 2026-04-05 14:17:20 UTC\r\nIDATLOADER (aka HIJACKLOADER, GHOSTPULSE) has become prevalent in 2024, using advanced and new\r\ntechniques such as BPL Sideloading, which Kroll reported on in June. Kroll observes IDATLOADER distributing\r\nmalware such as ASYNCRAT, PURESTEALER, REMCOS, STEALC and what some might describe as a recent\r\nepidemic in LUMMASTEALER infections.\r\nIDATLOADER received its name because of how it stores its malicious payload in the IDAT chunk of the\r\nportable network graphics (PNG) file format. First discovered in 2023, Kroll has seen IDATLOADER used by\r\nnumerous cybercrime actors across a range of technical abilities and objectives. These include initial access\r\nbrokers, data brokers and more advanced actors associated with ransomware such as KTA106 (Shathak, GOLD\r\nCABIN).\r\nEvidence of CARBANAK\r\nIn Kroll’s tracking of IDATLOADER, analysts identified one sample that stuck out from the rest. Analysis of the\r\nsample indicated that it was a recent version of the remote access trojan CARBANAK (aka ANUNAK), a\r\nmalware initially used by and named after the infamous cyber-crime group Carbanak (KTA008), which is widely\r\nregarded as an advanced persistent threat (APT).\r\nThe malware itself is referred to as ANUNAK by its developer. The activity associated with Carbanak is often\r\ntracked as interlinked subgroups, such as FIN7 and Cobalt Gang, by sections of the information security\r\ncommunity. Regardless of operational nuance, all this activity falls under the sophisticated, financially motivated\r\nAPT disposition.\r\nGroups associated with the KTA008 cluster have been active since 2012,\r\nand they have shifted focus from financial fraud and point-of-sale malware to ransomware attacks. In doing so,\r\nthey have coordinated with many well-known ransomware families, such as LOCKBIT, DARKSIDE, REVIL and\r\nBLACKSUIT.\r\nThe groups often target large corporations in sectors such as retail, hospitality, finance, construction and defense.\r\nThe groups have also recently used numerous watering hole lures to download LUMMASTEALER, which further\r\nlinks them to our findings.\r\nMalware Analysis\r\nKroll Cyber Threat Intelligence team’s generative intelligence pipeline, the malware and group monitoring\r\nplatform (MGMP), detected an anomalous malicious sample dropped by IDATLOADER and flagged it for further\r\nhttps://www.kroll.com/en/insights/publications/cyber/carbanak-anunak-distributed-via-idatloader-hijackloader\r\nPage 1 of 3\n\nanalysis.\r\nA sample found inside the IDATLOADER payload was itself encapsulated in a PNG file in a basic form of\r\nstenography. The original file appeared to be a screenshot of a window from the Italian version of the open-source\r\nprogram Scribus. The file was modified such that it maintained the PNG header. However, when opened in an\r\nimage viewer, it was easy to see that its pixel data had been corrupted, indicating that the purpose of this\r\nstenography was likely to bypass automated security tooling. \r\nFigure 1: Section of the image showing corrupted pixel data where payload was encapsulated\r\nThe sample itself exhibits behaviors as previously noted for CARBANAK. In particular, the collection of\r\nprocesses and services on the system, multiple threads, and use of named pipes for inter-thread communication.\r\nFigure 2: Output of process monitor showing services information gathering\r\nhttps://www.kroll.com/en/insights/publications/cyber/carbanak-anunak-distributed-via-idatloader-hijackloader\r\nPage 2 of 3\n\nFigure 3: Malware accessing named pipe usage\r\nWhen debugging the sample, indicators were present that linked this to CARBANAK malware. For example, a\r\nstring matching a format commonly used as an ID by the malware.\r\nFigure 4: CARBANAK identification string present in memory\r\nAdditionally, in-memory references to the malware’s internal name (ANUNAK) and configuration can be found.\r\nFigure 5: CARBANAK configuration and internal name present in process memory\r\nBecause of this, Kroll assesses with high confidence that this sample is CARBANAK/ANUNAK malware.\r\nThe presence of the CARBANAK malware inside of a IDATLOADER payload could indicate that some or all of\r\nthe Carbanak cluster of APT groups are preparing for or participating in a new campaign using IDATLOADER to\r\nload their malicious payloads.\r\nKroll is tracking this new activity cluster as KTAC005.\r\nIt should be noted that the source code for CARBANAK was leaked in 2019, so it cannot be ruled out that a new\r\nactor could be utilizing the remote access trojan RAT. However, due to the complexity of the malware and the\r\nnature of the leak, Kroll assesses that this is less likely to be the case.\r\nBased on KTA008’s previous behavior, we could now be witnessing IDATLOADER being adopted in targeted\r\nattacks by sophisticated threat actors alongside its abundant use in the propagation of commodity malware.\r\nSource: https://www.kroll.com/en/insights/publications/cyber/carbanak-anunak-distributed-via-idatloader-hijackloader\r\nhttps://www.kroll.com/en/insights/publications/cyber/carbanak-anunak-distributed-via-idatloader-hijackloader\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://www.kroll.com/en/insights/publications/cyber/carbanak-anunak-distributed-via-idatloader-hijackloader" ], "report_names": [ "carbanak-anunak-distributed-via-idatloader-hijackloader" ], "threat_actors": [ { "id": "26a04131-2b8c-4e5d-8f38-5c58b86f5e7f", "created_at": "2022-10-25T15:50:23.579601Z", "updated_at": "2026-04-10T02:00:05.360509Z", "deleted_at": null, "main_name": "TA551", "aliases": [ "TA551", "GOLD CABIN", "Shathak" ], "source_name": "MITRE:TA551", "tools": [ "QakBot", "IcedID", "Valak", "Ursnif" ], "source_id": "MITRE", "reports": null }, { "id": "c9617bb6-45c8-495e-9759-2177e61a8e91", "created_at": "2022-10-25T15:50:23.405039Z", "updated_at": "2026-04-10T02:00:05.387643Z", "deleted_at": null, "main_name": "Carbanak", "aliases": [ "Carbanak", "Anunak" ], "source_name": "MITRE:Carbanak", "tools": [ "Carbanak", "Mimikatz", "PsExec", "netsh" ], "source_id": "MITRE", "reports": null }, { "id": "9de1979b-40fc-44dc-855d-193edda4f3b8", "created_at": "2025-08-07T02:03:24.92723Z", "updated_at": "2026-04-10T02:00:03.755516Z", "deleted_at": null, "main_name": "GOLD LOCUST", "aliases": [ "Anunak", "Carbanak", "Carbon Spider ", "FIN7 ", "Silicon " ], "source_name": "Secureworks:GOLD LOCUST", "tools": [ "Carbanak" ], "source_id": "Secureworks", "reports": null }, { "id": "610a7295-3139-4f34-8cec-b3da40add480", "created_at": "2023-01-06T13:46:38.608142Z", "updated_at": "2026-04-10T02:00:03.03764Z", "deleted_at": null, "main_name": "Cobalt", "aliases": [ "Cobalt Group", "Cobalt Gang", "GOLD KINGSWOOD", "COBALT SPIDER", "G0080", "Mule Libra" ], "source_name": "MISPGALAXY:Cobalt", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "220e1e99-97ab-440a-8027-b672c5c5df44", "created_at": "2022-10-25T16:47:55.773407Z", "updated_at": "2026-04-10T02:00:03.649501Z", "deleted_at": null, "main_name": "GOLD KINGSWOOD", "aliases": [ "Cobalt Gang ", "Cobalt Spider " ], "source_name": "Secureworks:GOLD KINGSWOOD", "tools": [ "ATMSpitter", "Buhtrap", "Carbanak", "Cobalt Strike", "CobtInt", "Cyst", "Metasploit", "Meterpreter", "Mimikatz", "SpicyOmelette" ], "source_id": "Secureworks", "reports": null }, { "id": "bb8702c5-52ac-4359-8409-998a7cc3eeaf", "created_at": "2023-01-06T13:46:38.405479Z", "updated_at": "2026-04-10T02:00:02.961112Z", "deleted_at": null, "main_name": "FIN7", "aliases": [ "ATK32", "G0046", "G0008", "Sangria Tempest", "ELBRUS", "GOLD NIAGARA", "Coreid", "Carbanak", "Carbon Spider", "JokerStash", "CARBON SPIDER" ], "source_name": "MISPGALAXY:FIN7", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "40b623c7-b621-48db-b55b-dd4f6746fbc6", "created_at": "2024-06-19T02:03:08.017681Z", "updated_at": "2026-04-10T02:00:03.665818Z", "deleted_at": null, "main_name": "GOLD CABIN", "aliases": [ "Shathak", "TA551 " ], "source_name": "Secureworks:GOLD CABIN", "tools": [], "source_id": "Secureworks", "reports": null }, { "id": "ed3810b7-141a-4ed0-8a01-6a972b80458d", "created_at": "2022-10-25T16:07:23.443259Z", "updated_at": "2026-04-10T02:00:04.602946Z", "deleted_at": null, "main_name": "Carbanak", "aliases": [ "Anunak", "Carbanak", "Carbon Spider", "ELBRUS", "G0008", "Gold Waterfall", "Sangria Tempest" ], "source_name": "ETDA:Carbanak", "tools": [ "AVE_MARIA", "Agentemis", "AmmyyRAT", "Antak", "Anunak", "Ave Maria", "AveMariaRAT", "BABYMETAL", "BIRDDOG", "Backdoor Batel", "Batel", "Bateleur", "BlackMatter", "Boostwrite", "Cain \u0026 Abel", "Carbanak", "Cl0p", "Cobalt Strike", "CobaltStrike", "DNSMessenger", "DNSRat", "DNSbot", "DRIFTPIN", "DarkSide", "FOXGRABBER", "FlawedAmmyy", "HALFBAKED", "JS Flash", "KLRD", "MBR Eraser", "Mimikatz", "Nadrac", "Odinaff", "POWERPIPE", "POWERSOURCE", "PsExec", "SQLRAT", "Sekur", "Sekur RAT", "SocksBot", "SoftPerfect Network Scanner", "Spy.Agent.ORM", "TEXTMATE", "TeamViewer", "TiniMet", "TinyMet", "Toshliph", "VB Flash", "WARPRISM", "avemaria", "cobeacon" ], "source_id": "ETDA", "reports": null }, { "id": "f4f16213-7a22-4527-aecb-b964c64c2c46", "created_at": "2024-06-19T02:03:08.090932Z", "updated_at": "2026-04-10T02:00:03.6289Z", "deleted_at": null, "main_name": "GOLD NIAGARA", "aliases": [ "Calcium ", "Carbanak", "Carbon Spider ", "FIN7 ", "Navigator ", "Sangria Tempest ", "TelePort Crew " ], "source_name": "Secureworks:GOLD NIAGARA", "tools": [ "Bateleur", "Carbanak", "Cobalt Strike", "DICELOADER", "DRIFTPIN", "GGLDR", "GRIFFON", "JSSLoader", "Meterpreter", "OFFTRACK", "PILLOWMINT", "POWERTRASH", "SUPERSOFT", "TAKEOUT", "TinyMet" ], "source_id": "Secureworks", "reports": null }, { "id": "2dfaa730-7079-494c-b2f0-3ff8f3598a51", "created_at": "2022-10-25T16:07:23.474746Z", "updated_at": "2026-04-10T02:00:04.623746Z", "deleted_at": null, "main_name": "Cobalt Group", "aliases": [ "ATK 67", "Cobalt Gang", "Cobalt Spider", "G0080", "Gold Kingswood", "Mule Libra", "TAG-CR3" ], "source_name": "ETDA:Cobalt Group", "tools": [ "ATMRipper", "ATMSpitter", "Agentemis", "AmmyyRAT", "AtNow", "COOLPANTS", "CobInt", "Cobalt Strike", "CobaltStrike", "Cyst Downloader", "Fareit", "FlawedAmmyy", "Formbook", "Little Pig", "Metasploit Stager", "Mimikatz", "More_eggs", "NSIS", "Nullsoft Scriptable Install System", "Pony Loader", "Ripper ATM", "SDelete", "Siplog", "SoftPerfect Network Scanner", "SpicyOmelette", "Taurus Builder", "Taurus Builder Kit", "Taurus Loader", "Terra Loader", "ThreatKit", "VenomKit", "cobeacon", "win.xloader" ], "source_id": "ETDA", "reports": null }, { "id": "90f216f2-4897-46fc-bb76-3acae9d112ca", "created_at": "2023-01-06T13:46:39.248936Z", "updated_at": "2026-04-10T02:00:03.260122Z", "deleted_at": null, "main_name": "GOLD CABIN", "aliases": [ "Shakthak", "TA551", "ATK236", "G0127", "Monster Libra" ], "source_name": "MISPGALAXY:GOLD CABIN", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "bfded1cf-be73-44f9-a391-0751c9996f9a", "created_at": "2022-10-25T15:50:23.337107Z", "updated_at": "2026-04-10T02:00:05.252413Z", "deleted_at": null, "main_name": "FIN7", "aliases": [ "FIN7", "GOLD NIAGARA", "ITG14", "Carbon Spider", "ELBRUS", "Sangria Tempest" ], "source_name": "MITRE:FIN7", "tools": [ "Mimikatz", "AdFind", "JSS Loader", "HALFBAKED", "REvil", "PowerSploit", "CrackMapExec", "Carbanak", "Pillowmint", "Cobalt Strike", "POWERSOURCE", "RDFSNIFFER", "SQLRat", "Lizar", "TEXTMATE", "BOOSTWRITE" ], "source_id": "MITRE", "reports": null }, { "id": "c11abba0-f5e8-4017-a4ee-acb1a7c8c242", "created_at": "2022-10-25T15:50:23.744036Z", "updated_at": "2026-04-10T02:00:05.294413Z", "deleted_at": null, "main_name": "Cobalt Group", "aliases": [ "Cobalt Group", "GOLD KINGSWOOD", "Cobalt Gang", "Cobalt Spider" ], "source_name": "MITRE:Cobalt Group", "tools": [ "Mimikatz", "More_eggs", "SpicyOmelette", "SDelete", "Cobalt Strike", "PsExec" ], "source_id": "MITRE", "reports": null }, { "id": "d85adfe3-e1c3-40b0-b8bb-d1bacadc4d82", "created_at": "2022-10-25T16:07:23.619566Z", "updated_at": "2026-04-10T02:00:04.690061Z", "deleted_at": null, "main_name": "FIN7", "aliases": [ "APT-C-11", "ATK 32", "G0046", "Gold Niagara", "GrayAlpha", "ITG14", "TAG-CR1" ], "source_name": "ETDA:FIN7", "tools": [ "7Logger", "Agentemis", "Anubis Backdoor", "Anunak", "Astra", "BIOLOAD", "BIRDWATCH", "Bateleur", "Boostwrite", "CROWVIEW", "Carbanak", "Cobalt Strike", "CobaltStrike", "DICELOADER", "DNSMessenger", "FOWLGAZE", "HALFBAKED", "JSSLoader", "KillACK", "LOADOUT", "Lizar", "Meterpreter", "Mimikatz", "NetSupport", "NetSupport Manager", "NetSupport Manager RAT", "NetSupport RAT", "NetSupportManager RAT", "POWERPLANT", "POWERSOURCE", "RDFSNIFFER", "Ragnar Loader", "SQLRAT", "Sardonic", "Sekur", "Sekur RAT", "TEXTMATE", "Tirion", "VB Flash", "cobeacon" ], "source_id": "ETDA", "reports": null }, { "id": "04e34cab-3ee4-4f06-a6f6-5cdd7eccfd68", "created_at": "2022-10-25T16:07:24.578896Z", "updated_at": "2026-04-10T02:00:05.039955Z", "deleted_at": null, "main_name": "TA551", "aliases": [ "G0127", "Gold Cabin", "Monster Libra", "Shathak", "TA551" ], "source_name": "ETDA:TA551", "tools": [ "BokBot", "CRM", "Gozi", "Gozi CRM", "IceID", "IcedID", "Papras", "Snifula", "Ursnif", "Valak", "Valek" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434559, "ts_updated_at": 1775792243, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/f5be6d41943b1acbd1ce5c55d970e900593acdf3.pdf", "text": "https://archive.orkl.eu/f5be6d41943b1acbd1ce5c55d970e900593acdf3.txt", "img": "https://archive.orkl.eu/f5be6d41943b1acbd1ce5c55d970e900593acdf3.jpg" } }