The Carbanak malware was injected into the bank targets using sophisticated spear phishing emails. When employees clicked on the email attachments, they downloaded malware onto their computers. The malware used was completely undetectable by anti-malware programs. The malware took advantage of a zero-day exploit to install itself on users’ machines. It lurked for a long