New Carbanak / Anunak Attack Methodology

Trustwave SpiderLabs documents a Carbanak/Anunak campaign targeting hotels and restaurants that uses phone-based social engineering to deliver malicious Word attachments with embedded VBS loaders (AdobeUpdateManagementTool.vbs) which fetch and run additional tools. The multi-stage infection performs reconnaissance (Nmap, RDP tools), privilege escalation (el32/el64 exploits, CVE-2013-3660), persistent backdoors (bf.exe injected into svchost), remote control, POS memory scraping for track data, and encrypted exfiltration to hardcoded C2 IPs/domains; the report includes file hashes, registry/service persistence details, beaconing patterns, and network IOCs.