FireEye researchers find the source code of the Carbanak malware, developed by a hacker group that stole €1B+ from banks, has been on VirusTotal for two years
Context & Ripple Effects
The Carbanak story had seemed closed: Europol's $1.2B accounting of thefts from 100+ banks in 40 countries and the 2018 arrest of the gang's leader in Spain framed it as a disrupted operation. FireEye's finding reopens it — the malware's full source code has been sitting on VirusTotal, the industry's shared scanning repository, for two years.
There is a direct precedent in the corpus: when Russian-made Carberp leaked in 2013, WikiLeaks later reported the CIA borrowed elements of it for its own Windows tooling. Leaked financial-malware source does not die with the crew that wrote it.
First-order effects
- Banks and incident-response teams gain the complete Carbanak codebase to dissect, letting them write detections against capabilities previously inferred only from samples — while any criminal with a VirusTotal account can do the same.
Second-order effects
- Expect Carbanak-derived variants in future bank and ATM heists by crews unconnected to the original gang, forcing defenders to treat the arrest-era signatures as obsolete; VirusTotal also faces pointed questions about how a full source tree went unnoticed in its corpus for two years.
Third-order effects
- If the Carberp-to-CIA and now public-Carbanak pattern holds, law-enforcement takedowns dismantle organizations but not their tooling: financial malware lineages persist as reusable open-source-style assets, eroding attribution and making 'the gang is caught' an incomplete endpoint for cybercrime cases.
The trend: Cybercriminal tooling is outliving the groups that built it, as leaked source code turns one-time attack kits into shared infrastructure that survives arrests.