Threat Group FIN7 Targets the U.S. Automotive Industry

### Executive Summary Arctic Wolf Labs identified a late-2023 FIN7 spear-phishing campaign targeting IT personnel at a large U.S. automotive manufacturer using a typosquatted IP-scanner lure that delivered WsTaskLoad.exe which staged and deployed the Anunak/Carbanak payload; the intrusion established persistence via OpenSSH and SSH tunnels, and the report provides detailed technical analysis, IOCs (hashes, domains, IPs), a YARA detection rule, MITRE ATT&CK mapping, and mitigation recommendations.