Categories: NewsSecurity

Carbanak Cybercrime Group Uses Public Google Services to Control Malware Operations

Cybercrime gangs are becoming bolder at every turn. The Carbanak group is back after a brief absence, and they are now using cloud servers to operate their command-and-control servers. To be more precise, the group employs Google’s servers to distribute and control its malware. A brash move that goes to show cyber criminals aren’t afraid of anything.

Carbanak Returns With A Bang

Forcepoint Security Labs researchers announced that they have spotted new activity linked to the Carbanak crime gang. This particular group of criminals is responsible for hacking and stealing funds from various financial institutions throughout the course of 2015. By using highly sophisticated malware, the group was able to infiltrate computer networks and conduct their business without being caught.

Damages done by the Carbanak group are estimated to top US$1bn. This notorious group of criminals stole the funds over the course of two years by integrating close to 100 banks in several dozen countries. In most cases, they targeted bank employees with spear phishing campaigns. Primary targets include Russian, Danish, and American financial institutions. None of the money stolen during these attacks was ever recovered.



As of 2017, the Carbanak group is back with a vengeance, and they have a new trick up their sleeve. It turns out they use Google’s Apps Script, Sheets, and Forms cloud-based services. All of these platforms are used to control their command-and-control operations related to the new type of malware being spread. The objective remains unchanged, defrauding banks and customers whenever they can.

Related Post

The malware is being deployed through an RTF document containing an encoded Visual Basic script. Once a user is infected, the information will be sent back to the C&C server, which then makes a separate spreadsheet tab for each victim.In doing so, the Carbanak group uses a free tool to maintain a virtual “trophy hall” of victims, so to speak.

While most cybercrime gangs tend to lurk in the hidden corners of the internet, Carbanak is taking a very different approach. In fact, they are hiding in plain sight, and use one of the world’s largest technology companies’ public services. Google has been notified of this incident, but for now, no resolution has been offered yet.

One thing of particular concern is how using Google’s services will benefit their command-and-control server operations. New domains, or domains without any reputation, are less likely to be visited by recipients of the spear phishing emails. Google, on the other hand, is a household brand most people are all too familiar with. We can only hope the technology giant takes the necessary actions sooner rather than later.

If you liked this article, follow us on Twitter @themerklenews and make sure to subscribe to our newsletter to receive the latest bitcoin, cryptocurrency, and technology news.

JP Buntinx

JP Buntinx is a FinTech and Bitcoin enthusiast living in Belgium. His passion for finance and technology made him one of the world's leading freelance Bitcoin writers, and he aims to achieve the same level of respect in the FinTech sector.

Share
Published by
JP Buntinx

Recent Posts

WIF Set to Overtake BONK? Lunex Soars with 100x Potential in Altcoin Season

As altcoin season heats up, all eyes are on the rising stars—especially Lunex, which is…

5 hours ago

Binance Coin Price Dips: BNB Holders Rush To Lunex Presale To Hedge Their Long Positions

While the broader market witnessed a notable upward movement, Binance Coin (BNB) experienced a decline…

5 hours ago

Crypto Stalwarts Forecasted 800% Growth in Innovative Projects: VeChain, Rollblock and Polkadot!

This blazing crypto bull run has investors looking for the next top altcoins set to…

5 hours ago

Dogecoin Price Set To Recreate 36,000% Rally From 2021 After Pennant Formation

The Dogecoin price is back in the limelight, captivating the crypto world with its recent…

5 hours ago

Is XRP About to Explode? How Trump’s Victory Is Affecting XRP Price Amidst JetBolt Growth

Ripple’s XRP showed a 68% price increase in the last 7 days following Trump's victory,…

5 hours ago

Ethereum Down While Bitcoin, Solana, and JetBolt Skyrocket In End November 2024

Ethereum stumbles as Bitcoin surges past $97K, Solana eyes new highs, and JetBolt’s presale shakes…

8 hours ago