CNAB is a standardized Brazilian banking file format used in remittance and return workflows. Businesses use these files to exchange payment instructions, reconcile transactions, and automate routine financial operations with banks. In practice, CNAB files often sit on systems that handle payroll, collections, supplier payments, and other sensitive accounting processes.
From a security perspective, CNAB matters because it is a strong indicator of financially valuable infrastructure. Malware or intruders that search for CNAB files are usually trying to identify hosts tied to payment operations, not just steal arbitrary documents. That can help them prioritize targets for fraud, extortion, or later resale of access. Defenders can use CNAB-related file paths, access events, and unusual archive or transfer activity as signals of compromise, especially on finance workstations and servers where these files should be handled in known workflows.