FIN7
No sourced public emblem in this profile.
reference profile · reported nexus: RU (not nationality)
Groups targeting financial organizations or people with significant financial assets.
Source-reported aliases: CARBON SPIDER, GOLD NIAGARA, Calcium, ATK32, G0046, G0008, Coreid, Carbanak, Sangria Tempest, ELBRUS, Carbon Spider, JokerStash, WILD COMET. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://en.wikipedia.org/wiki/Carbanak
https://app.box.com/s/p7qzcury97tuwk26694uutujwqmwqyhe
https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/
https://www.computerweekly.com/news/252446153/Three-Carbanak-cyber-heist-gang-members-arrested
https://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf
https://attack.mitre.org/groups/G0008/
https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
https://threatpost.com/fileless-malware-campaigns-tied-to-same-attacker/124369/
https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
https://blog.morphisec.com/fin7-attacks-restaurant-industry