Carbanak: the bank robbers who came in by email

The story

In 2015, the security company Kaspersky Lab published research on a criminal campaign it named Carbanak. The group had been breaking into banks, mostly in Russia but also in the United States, Germany, China, Ukraine and elsewhere.

It started with phishing emails to bank employees. Attachments carried malware into the bank’s network. Once inside, the group used that access to move money in several ways. Some cash machines were told to dispense cash at set times, when someone working for the group was waiting nearby. Other money was moved through the banks’ own transfer systems, or added to balances in accounts the group controlled.

Why it mattered

Carbanak showed that bank robbers no longer needed to walk into a bank. By quietly studying how a bank’s own staff moved money, the group made cash machines and transfer systems do the work, and it all began with an email attachment. Europol announced the arrest of the group’s suspected leader in Spain in 2018, though related activity appears to have continued.

The lesson today

The bank’s vaults and cash machines were never physically touched. Everything started with one employee opening one email. Attackers who get in can do a lot with the access they find, which is why protection has to look for unusual behavior on computers as well as at the front door.