Carbanak: Thieves watch bankers work before imitating them

A distributor can hand over money without a legitimate customer asking for a withdrawal. Behind this scene is sometimes a long period of observation. Kaspersky investigators describe in 2015 a campaign aimed directly at banks: Carbanak.

Targeted emails and their attachments allow a first intrusion. Attackers then progress through the network to observe employee and administrator positions. They record screens and learn the necessary gestures to move money without depending on a fake customer at the counter.

Depending on the institutions and systems affected, exits take different forms: fraudulent transfers, account manipulation or withdrawals from distributors, recovered by accomplices. The strength of the campaign lies in the imitation of ordinary banking procedures from an illegitimate internal position.

Anomalies lead banks, law enforcement and specialists to bring incidents closer together. Kaspersky reported losses of up to $1 billion. This is a cumulative estimate on several victims, not a billion stolen from a single chest in one night.

In 2018, an international police operation announced the arrest in Spain of an alleged leader associated with the Carbanak and Cobalt campaigns. The police description covers several years, several tools and many countries. The name of a software does not necessarily mean a single organization that remains unchanged.

The case is understood by reversing the usual image of the hacker: attackers are not just looking for an open door. They take the time to learn what an authorized person would do after going through it.