Russian APT Group Thwarted in Attack on US Automotive Manufacturer

FIN7 (aka Carbon Spider / ELBRUS / Sangria Tempest) conducted a spear-phishing campaign in late 2023 against a large US-based automotive manufacturer, luring high-privilege IT staff with a malicious URL masquerading as an IP scanning tool. The actors delivered the Anunak backdoor and used living-off-the-land binaries and scripts to establish footholds; BlackBerry's threat research team detected and disrupted the campaign before the ransomware stage could be executed.