Carbanak gang is back and packing new guns

This ESET analysis documents renewed activity by the Carbanak financial APT targeting banks, payment processors, Forex firms and a US casino hotel using spearphishing, RTF exploits and leaked/known vulnerabilities (including CVE-2015-1770 and CVE-2015-2426). The report details multiple malware families (Carbanak/Win32/Spy.Sekur, Win32/Spy.Agent.ORM, Win32/Wemosis, Tiny Meterpreter), shared technical traits (code similarities, code-signing certificates), provides extensive IoCs (file hashes, C2 domains and IPs, cert details) and sinkhole hit statistics, and concludes the group remains active and financially motivated.