FIN7 targets American automaker’s IT staff in phishing attacks

FIN7 targeted privileged IT employees at a large U.S. automaker with spear-phishing that led to a typosquatted Advanced IP Scanner installer (WsTaskLoad.exe) which executed a multi-stage loader (including WAV/DLL/shellcode) to decrypt dmxl.bin and deploy the Anunak backdoor; researchers observed LoLBas, obfuscated PowerShell ('PowerTrash'), scheduled tasks and OpenSSH usage, though the intrusion did not progress beyond the initial host.