At the end of March 2018, the leader of the criminal gang behind the Carbanak and Cobalt malware attacks was arrested in Spain. Since 2013, the gang had been using forms of malware (called Anunak, Carbanak, and Cobalt) to attack banks, e-payment systems, and financial institutions in more than 40 countries. This criminal activity caused a cumulative loss of over €1 billion to the financial industry. By sending spear phishing emails with a malicious attachment impersonating legitimate companies to bank employees, the gang gained access to internal banking networks and infected the servers controlling the ATMs.

The operation was conducted by the Spanish National Police with the support of Europol, the FBI, and the Romanian, Moldovan, Belarussian, and Taiwanese authorities as well as private cyber security companies.