Threat actor · all actors
CarbanakG0008 state
🇷🇺 RU
aka Carbanak, Anunak, FIN7, CARBON SPIDER, GOLD NIAGARA, Calcium, ATK32, G0046, G0008, Coreid, Sangria Tempest, ELBRUS, JokerStash, WILD COMET
Last updated: 2026-08-20
About this actor
[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercriminal group that has used [Carbanak](https://attack.mitre.org/software/S0030) malware to target financial institutions since at least 2013. [Carbanak](https://attack.mitre.org/groups/G0008) may be linked to groups tracked separately as [Cobalt Group](https://attack.mitre.org/groups/G0080) and [FIN7](https://attack.mitre.org/groups/G0046) that have also used [Carbanak](https://attack.mitre.org/software/S0030) malware.(Citation: Kaspersky Carbanak)(Citation: FireEye FIN7 April 2017)(Citation: Europol Cobalt Mar 2018)(Citation: Secureworks GOLD NIAGARA Threat Profile)(Citation: Secureworks GOLD KINGSWOOD Threat Profile)
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
Microsoftweather-system names
CrowdStrikenation-animal names
MandiantFIN financially-motivated
Secureworkscolour-metal names
Unclassifiedno scheme matched
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 14 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
No activity events recorded.
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
| No attributed CVEs. | |||||
T1036Masquerading ↗T1036.004Masquerade Task or Service ↗T1036.005Match Legitimate Resource Name or Location ↗T1078Valid Accounts ↗T1102Web Service ↗T1102.002Bidirectional Communication ↗T1218System Binary Proxy Execution ↗T1218.011Rundll32 ↗T1219Remote Access Tools ↗T1543Create or Modify System Process ↗T1543.003Windows Service ↗T1588Obtain Capabilities ↗T1588.002Tool ↗T1686Disable or Modify System Firewall ↗
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
CA-7 | 10 / 14 | 71% |
SI-4 | 10 / 14 | 71% |
CM-2 | 9 / 14 | 64% |
CM-6 | 9 / 14 | 64% |
CM-7 | 9 / 14 | 64% |
AC-3 | 8 / 14 | 57% |
SI-3 | 8 / 14 | 57% |
AC-2 | 7 / 14 | 50% |
AC-6 | 7 / 14 | 50% |
SI-7 | 7 / 14 | 50% |
AC-5 | 5 / 14 | 36% |
CM-5 | 5 / 14 | 36% |
IA-2 | 5 / 14 | 36% |
SC-7 | 5 / 14 | 36% |
SI-10 | 5 / 14 | 36% |
Co-occurring actors
None.
Similar actors
Similar TTPs
- POLONIUM 0.25
- DarkVishnya 0.23
- PROMETHIUM 0.22
- PittyTiger 0.21
- C0018 0.21
Same nation-state
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00