Leader of hacker gang known as Carbanak, who used malware attacks to steal €1B+ from banks and ATMs, caught in Spain
For the past five years, a gang of hackers known as Carbanak has been targeting banks around the world, stealing well over $1 billion in total.
Context & Ripple Effects
The Carbanak case has been building for years: Kaspersky first flagged the campaign in early 2015 with its $300M estimate across 100+ financial institutions, after an earlier wave of targeted phishing and malware hits on Eastern European banks. By mid-2018, Europol put the full damage at roughly $1.2B stolen from more than 100 banks in 40 nations.
The Spanish capture of the gang's leader turns a five-year forensic story into a law-enforcement one — and it lands just as investigators were still mapping how the operation worked.
First-order effects
- Carbanak loses its top operator while Europol-coordinated investigators hold both the man and, per their own accounting, the fullest picture yet of the $1.2B theft from 100+ banks in 40 nations — banks running the affected ATM and payment infrastructure get their most direct line of defense intelligence to date.
Second-order effects
- A captured leader plus leaked tooling compounds the risk: FireEye later found the Carbanak source code sitting publicly on VirusTotal for two years, meaning rival crews can reuse proven bank-attack code even as the original gang is dismantled.
Third-order effects
- The arrest models the playbook Europol and the FBI applied again months later in the GozNym takedown of a leader and ten members — cross-border joint operations replacing national prosecutions as the default response to banking malware, pushing such gangs toward decentralization and disposable identities.
The trend: Banking cybercrime is shifting from long-running stealth campaigns toward multinational police takedowns, with leaked malware source code keeping attack capability alive even after leaders are caught.