Carbanak Backdoor

The Carbanak Backdoor is a notorious malware, designed to exploit and damage computer systems. It is associated with the FIN7 threat group, also known as the "Carbanak Group", although not all usage of the Carbanak Backdoor can be directly linked to FIN7. This malicious software infiltrates systems often through suspicious downloads, emails, or websites, and once inside, it has the capability to steal personal information, disrupt operations, or even hold data hostage for ransom. Over time, the Carbanak Backdoor toolkit has been used extensively by FIN7 members for reconnaissance purposes and to gain a foothold on infected systems. IBM X-Force researchers found additional evidence connecting the Domino Backdoor to ITG14’s Carbanak Backdoor. Around the same period, they also uncovered NewWorldOrder Loader samples, with the filename ThunderboltService.exe, which were used to load the Carbanak Backdoor. The same domain that hosted the Cobalt Strike Beacon payload was also found to be hosting a Carbanak backdoor sample compiled in February 2017. This discovery further solidified the connection between these different pieces of malware and their shared purpose. In addition to the Carbanak Backdoor, the researchers discovered other tools being used in conjunction with it. One of the DLLs identified was an instance of the Carbanak backdoor itself, while another DLL was a tool tracked by FireEye as RDFSNIFFER. This tool allows an attacker to hijack instances of the NCR Aloha Command Center Client application and interact with victim systems via existing legitimate 2FA sessions. These findings highlight the sophisticated nature of the attacks orchestrated using the Carbanak Backdoor, and the significant threat it poses to digital security.