Anunak

Anunak, also known as Carbanak or FIN7, is a prominent threat actor in the cybercrime landscape. The group emerged around 2013 and specializes in financial theft, primarily targeting Eastern European banks, U.S. and European point-of-sale systems, and other entities. The name "Carbanak" was coined by Kaspersky, though the malware authors themselves refer to the backdoor as Anunak. This group has been known to work closely with other malicious entities such as Evil Corp and TA505, demonstrating a high level of coordination and shared objectives within the cybercriminal community. The group's modus operandi involves the use of sophisticated spear-phishing emails aimed at deploying the Anunak backdoor malware for financial gain and data theft. In one notable attack, they targeted a major multinational car maker using carefully crafted phishing emails. The initial payload initiated a multi-stage execution process to deploy the final payload, a backdoor known as Anunak or Carbanak. This process culminated in the loading and decryption of a file called ‘dmxl.bin,’ which contained the Anunak payload. The Anunak group utilizes living-off-the-land binaries, scripts, and libraries (lolbas) to infect systems and maintain persistence. They have been known to employ lures such as a free IP scanning tool to gain an initial foothold on the target systems. Once the employees are tricked into opening the link, the threat actor deploys its Anunak backdoor, allowing them to infiltrate the network. Despite changes in its composition over time, the Anunak group continues to pose a significant threat due to its versatile backdoor capabilities and persistent attack methodologies.