FIN7
Also known as CARBON SPIDER, GOLD NIAGARA, Calcium, ATK32, G0046, G0008, Coreid, Carbanak, Sangria Tempest, ELBRUS, JokerStash, WILD COMET, Anunak
1mentions, 7 days
1mentions, 30 days
Oct 31, 2026last mentioned
Groups targeting financial organizations or people with significant financial assets.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1078 Valid AccountsT1102.002 Bidirectional CommunicationT1218.011 Rundll32T1219 Remote Access ToolsT1543.003 Windows ServiceT1588.002 ToolT1686 Disable or Modify System Firewall
Recent activity
- HackerTube: YouTube built from videos recommended by HNhn · Oct 31, 2026
References
- https://en.wikipedia.org/wiki/Carbanak
- https://app.box.com/s/p7qzcury97tuwk26694uutujwqmwqyhe
- http://2014.zeronights.ru/assets/files/slides/ivanovb-zeronights.pdf
- https://web.archive.org/web/20161223002016/https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks
- https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor
- https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
- https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/
- https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain
- https://www.computerweekly.com/news/252446153/Three-Carbanak-cyber-heist-gang-members-arrested
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
- https://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf
- https://attack.mitre.org/groups/G0008/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.