The Great Bank Heist, or Death by 1,000 Cuts?
Summary: Kaspersky Lab attributed attacks on more than 100 banks to an Eastern European group it calls "Carbanak," which used spear-phishing emails with malware-laced Microsoft Office attachments to steal upwards of USD $300 million, possibly as high as USD $1 billion. Fox-IT and Group-IB had described the same group as "Anunak" in December 2014, and Fox-IT's Andy Chandler confirmed the two names refer to the same organization.
What's compelling: The attackers exploited Microsoft Office vulnerabilities for which patches had been available for months, and Fox-IT/Group-IB reported an average of 42 days between network compromise and the theft of cash - meaning the breach went undetected for weeks while the gang studied internal procedures and impersonated staff to push fraudulent transactions through SWIFT and ATM networks.
Read the original at Krebs on Security ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026