A technical breakdown published by Trend Micro maps the shared and divergent attack techniques of Carbanak and FIN7 — two financially motivated threat groups that, while sometimes conflated, are tracked by MITRE as distinct entities wielding the Carbanak backdoor alongside other specialized malware. Carbanak focuses on banking institutions; FIN7 targets food, hospitality, and retail establishments. Together, they represent MITRE ATT&CK's most thoroughly catalogued financially motivated threat cluster, covering 65 techniques across 11 tactics.
Initial Access and Execution
Both groups enter target environments through spear-phishing campaigns delivering attachments embedded with exploits. Post-access execution relies on a shared set of techniques including native API, PowerShell, Windows COM and Distributed COM, WMI, service execution, and user execution. Carbanak additionally abuses the Dynamic Data Exchange (DDE) client-server protocol and command-line interfaces. FIN7 takes advantage of Mshta (for VBScript execution) and scheduled tasks to run malicious code outside standard execution paths.
Persistence, Privilege Escalation, and Defense Evasion
Both groups maintain persistence through new service creation, startup folder entries via registry run keys, and valid account credential abuse. FIN7 additionally uses application shimming databases — most notably in campaigns delivering the Pillowmint point-of-sale malware — and process hooking to modify program behavior at runtime. For privilege escalation, both bypass Windows UAC mechanisms; Carbanak uses sudo on Linux systems, while FIN7 leverages process injection and DLL search order hijacking.
Defense evasion across both groups includes code signing, file obfuscation, software packing, masquerading, and process injection. Carbanak further disables security tools, deletes forensic artifacts, and modifies the registry to hide configuration data. FIN7 uses guardrails to restrict execution context, abuses indirect command execution utilities, evades virtualization and sandbox detection, and employs process hollowing.
Credential Access, Discovery, and Lateral Movement
Both groups harvest credentials through dumping (hash and cleartext) and input capture via API and web portals. Carbanak additionally conducts brute force attacks and extracts browser-stored credentials. For discovery, both map open application windows, running processes, remote system network identifiers, hardware information, network configuration, and system user data. Lateral movement is conducted via RDP, remote file copy, Windows admin shares, and — in Carbanak operations — pass-the-hash authentication using stolen NTLM hashes and direct logins to services accepting remote connections.
Collection, C2, and Exfiltration
The Carbanak backdoor itself provides keylogging, screenshot capture, cookie theft, malicious code injection into browser sessions, and traffic monitoring. Both groups communicate with compromised systems via commonly used ports to bypass firewall rules, use connection proxies to avoid direct C2 exposure, blend traffic into standard application layer protocols, and encrypt C2 communications with standard cryptographic protocols. Data exfiltration occurs through the C2 channel; FIN7 additionally compresses and encrypts collected data before transfer. The Tirion malware — positioned as a potential Carbanak replacement — extends screen and input capture capabilities in FIN7 operations.