Corkow

Also reported as Metel. Linked to Russia by one source.

Reports: 11
Last reported: 6 April 2026
Known CVEs: 8
Origin: Russia

ID: corkow
Sources: ETDA
Merge evidence: 0 alias matches

Reports per quarter

2014 Q4: 1 report
2015 Q1: no reports
2015 Q2: no reports
2015 Q3: no reports
2015 Q4: no reports
2016 Q1: 4 reports
2016 Q2: no reports
2016 Q3: no reports
2016 Q4: 1 report
2017 Q1: 2 reports
2017 Q2: no reports
2017 Q3: no reports
2017 Q4: no reports
2018 Q1: no reports
2018 Q2: no reports
2018 Q3: no reports
2018 Q4: no reports
2019 Q1: no reports
2019 Q2: no reports
2019 Q3: no reports
2019 Q4: no reports
2020 Q1: no reports
2020 Q2: no reports
2020 Q3: no reports
2020 Q4: no reports
2021 Q1: no reports
2021 Q2: no reports
2021 Q3: no reports
2021 Q4: no reports
2022 Q1: no reports
2022 Q2: no reports
2022 Q3: no reports
2022 Q4: no reports
2023 Q1: no reports
2023 Q2: no reports
2023 Q3: no reports
2023 Q4: no reports
2024 Q1: no reports
2024 Q2: no reports
2024 Q3: no reports
2024 Q4: no reports
2025 Q1: no reports
2025 Q2: no reports
2025 Q3: no reports
2025 Q4: no reports
2026 Q1: no reports
2026 Q2: 3 reports

Dated reports, 2014 Q4 to 2026 Q2.

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

6 April 2026

Metel – ATM balance rollbacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Metel – ATM balance rollbacks
6 April 2026

Corkow: Analysis of a business-oriented banking Trojan

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Corkow: Analysis of a business-oriented banking Trojan
6 April 2026

Metel Bank Robbers Borrowing from APT Attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Metel Bank Robbers Borrowing from APT Attacks
30 March 2017

Hi-Tech Crime Trends 2016

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hi-Tech Crime Trends 2016
1 February 2017

Read-The-Manual.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Read-The-Manual.pdf
14 December 2016

Kaspersky Security Bulletin 2016. Review of the year. Overall statistics for 2016

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kaspersky Security Bulletin 2016. Review of the year. Overall statistics for 2016
17 February 2016

Russian Police Prevented Massive Banking Sector Cyber Attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian Police Prevented Massive Banking Sector Cyber Attack
8 February 2016

APT-style bank robberies increase with Metel, GCMAN and Carbanak 2.0 attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT-style bank robberies increase with Metel, GCMAN and Carbanak 2.0 attacks
8 February 2016

APT-style bank robberies increase with Metel, GCMAN and Carbanak 2.0 attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT-style bank robberies increase with Metel, GCMAN and Carbanak 2.0 attacks
5 February 2016

Group-IB-Corkow-Report-EN.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor Group-IB-Corkow-Report-EN.pdf

Show all 11 reports Show fewer

13 November 2014

ivanovb-zeronights.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor ivanovb-zeronights.pdf

Newest first. Details opens the report in Explore.