fin7-carbanak

name	fin7-carbanak
description	Adversary-emulation profile for FIN7 (G0046; aka Carbanak, Carbon Spider, Sangria Tempest, GOLD NIAGARA, ELBRUS) — a financially motivated Russian-speaking crime group, mapping its TTPs to Decepticon tooling for authorized red-team emulation.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"FIN7, Carbanak, Carbon Spider, Sangria Tempest, GOLD NIAGARA, ELBRUS, ITG14, financially motivated, POS / payment-card theft, big game hunting, ransomware affiliate (Darkside, BlackMatter, Cl0p, Black Basta, REvil, ALPHV/BlackCat, LockBit), spearphishing with weaponized Office docs / LNK, malicious USB (BadUSB), POWERTRASH, Carbanak/Anunak backdoor, Lizar/Diceloader, JSS Loader, Cobalt Strike, AvNeutralizer/AuKill EDR killer, Checkmarks auto-exploit, ProxyShell, Kerberoasting, OpenSSH tunneling, ESXi ransomware — emulate this actor or build detections for it.","tags":"adversary-emulation, threat-intel, fin7, carbanak, carbon-spider, sangria-tempest, financially-motivated, ransomware, big-game-hunting, mitre-attack, g0046, red-team","mitre_attack":"T1583.001, T1583.006, T1587.001, T1588.002, T1608.001, T1608.004, T1608.005, T1591, T1591.004, T1566.001, T1566.002, T1190, T1195.002, T1091, T1078.003, T1204.001, T1204.002, T1059.001, T1059.003, T1059.005, T1059.007, T1059, T1559.002, T1106, T1218.005, T1218.011, T1047, T1053.005, T1569.002, T1674, T1620, T1547.001, T1543.003, T1546.011, T1036.004, T1133, T1210, T1558.003, T1003, T1027.010, T1027.016, T1140, T1553.002, T1562.001, T1564.001, T1564.003, T1036.005, T1571, T1497.002, T1087.002, T1069.002, T1057, T1082, T1033, T1124, T1021.001, T1021.004, T1021.005, T1572, T1071.004, T1008, T1102.002, T1219, T1105, T1005, T1113, T1125, T1567.002, T1486"}

FIN7 (Carbanak, Carbon Spider, Sangria Tempest) — Adversary Emulation Profile

FIN7 (MITRE ATT&CK G0046; also tracked as Carbanak, Carbon Spider, Sangria Tempest, GOLD NIAGARA, ELBRUS, and ITG14) is one of the most prolific and best-documented financially motivated cybercrime groups, active since at least 2013. Originally infamous for large-scale point-of-sale (POS) intrusions to steal payment-card data — operating behind the front company "Combi Security" — the group pivoted to "big game hunting" ransomware around 2020, running its own Darkside/BlackMatter Ransomware-as-a-Service and acting as an affiliate/tooling supplier for REvil, Cl0p, Black Basta, ALPHV/BlackCat, LockBit, and others. FIN7 is characterized by disciplined operational tradecraft: convincing social engineering (including spearphishing of IT staff and physically mailed BadUSB drives), heavily obfuscated custom loaders (POWERTRASH), signature backdoors (Carbanak/Anunak, Lizar/Diceloader), purchased/cracked commercial tooling (Cobalt Strike, Core Impact), and a productized EDR-killer (AvNeutralizer/AuKill) sold on criminal forums.

Attribution & motivation

• Sponsor / nation: Not a state-sponsored actor. FIN7 is an organized criminal enterprise assessed by multiple vendors to be Russian-speaking / Russia-based, with confirmed Ukrainian national members (per the 2018 U.S. DOJ indictment).
• Motivation: Financial. Early operations monetized stolen payment-card data sold on carding/darknet markets; later operations monetize via ransomware extortion (own RaaS brands and as a ransomware affiliate) and by selling intrusion tooling (e.g., the AvNeutralizer EDR killer) to other crews.
• Confidence: High for the activity cluster and financial motivation (corroborated by DOJ indictments/convictions and consistent CrowdStrike, Mandiant, Microsoft, SentinelOne, and Secureworks reporting). Note that the "Carbanak" backdoor has been used by more than one actor, so backdoor-only attributions to FIN7 should be treated with lower confidence than TTP-clustered attributions.

Targeting

• Sectors: Historically heavy on retail, restaurant, hospitality, and gaming (POS-era payment-card theft). Post-2020 ransomware era broadened to software, consulting, financial services, medical equipment/pharmaceutical, cloud services, media, food & beverage, transportation, utilities, manufacturing, legal, and the public sector, plus the automotive industry.
• Regions: Predominantly the United States (the DOJ described theft of card data from 100+ U.S. companies across 47 states), with European victims also reported.
• Victim profile: During POS operations, customer-facing businesses processing large card volumes. In the ransomware/BGH era, victim selection is revenue-driven (targets filtered by company revenue using ZoomInfo) and FIN7 specifically phishes to accelerate domain compromise.