Alert: Carbanak Malware Strikes Again With Updated Tactics

Wajahat Raja

January 8, 2024 - TuxCare expert team

Recent reports have highlighted the return of the Carbanak Malware. As per the reports, it’s a banking malware used in ransomware attacks that leverages updated tactics for increased effectiveness. As of now, the malware is known to have been distributed through various compromised websites and is seen impersonating different business-related software.

In this blog, we’ll look at how the Carbanak malware resurfaced when it was first identified, and its latest attack chain.

Understanding The Carbanak Malware

The wild eruption of Carbanak in the cyber threat landscape can be traced back to 2014. It’s known for sophisticated data exfiltration and remote control protocols and is a noteworthy threat when it comes to cybercrime in the banking sector.

Its anatomy can best be described as a backdoor designed to carry out espionage for illicit purposes. Attackers leveraging the Carbanak malware tactics use spear phishing emails to lure targets into opening and executing the malicious attachments contained within.

It’s worth mentioning here that the primary objective of such a campaign is to harness the illicit initial access and exploit it to remotely control the infected device. The control is then exploited further towards money processing services like ATMs or financial accounts.

Carbanak Malware Updates: The Latest Attack Chain

The latest attack chain uncovered by the NCC group entails that compromised websites are being used to host malicious installer files. Those keen on learning about the evolving tactics of Carbanak must know that these files pose as legitimate utilities but are developed to initiate deployment of the Carbanak malware.

It’s worth mentioning here that this development was brought to light as 442 malware attacks were reported in Noverment 2023, which is a 67% increase from the preceding year. In a recent cybercrime analysis, the NCC Group shed light on Carbanak and cybercrime in the banking sector. An excerpt from the report reads:

“Carbanak returned last month through new distribution chains and has been distributed through compromised websites to impersonate various business-related software.”

As far as developing familiarization with the attack chain is concerned, individuals and organizations seeking cybersecurity measures against financial malware must be aware of which softwares is being impersonated. Recent reports have mentioned that common examples of such software include HubSpot, Veeam, and Xero.

Carbanak Malware Tactics Unveiled

As per NCC’s report, the return of Carbanak is being deemed as a “Spotlight” when it comes to cybercrime in the banking sector. As far as the tactics are concerned, threat actors use human entry points to gain access by luring them in with phishing traps. Once the access is acquired, the threat actors begin to seize control over payment processing systems.

Having undergone immense evolution in recent years, the malware has now adapted to incorporate attacks on various vendors, allowing it to be more effective. As far as financial institution security is concerned, organizations hold developing familiarization with the Carbanak malware paramount.

Doing so can help them gain insights pertaining to malware detection and prevention and will aid in developing a cybersecurity strategy.

Conclusion

Recent reports have brought to light the reemergence of the Carbanak malware. As of now, it’s being used as a part of ransomware attacks leveraging updated tactics. Installer files pertaining to the malware can impersonate different vendors which poses a significant threat to financial institution security.

Given this, it’s imperative for organizations to implement robust cybersecurity measures to ensure protection against cybercrime in the banking sector and to improve their security posture.

The sources for this piece include articles in The Hacker News and Security Report.

Summary