FIN7__2015__Carbanak_APT_eng.pdf

Kaspersky Lab's Carbanak APT report (Feb 2015) documents a large, financially motivated cybercrime campaign that used spear-phishing and known Office/Word exploits to deploy the Carbanak backdoor against banks and financial institutions worldwide; the attackers performed reconnaissance (screenshots/video/keylogging), lateral movement (PsExec, SSH backdoors, Ammyy), manipulated banking systems and ATMs to extract funds, and operated an extensive C2 and plugin infrastructure — the report includes detailed malware analysis, command mappings, IOCs, detection scripts and operational findings, with estimated cumulative losses up to ~$1 billion USD.