FIN7 Cybercrime Group Targeting U.S. Auto Industry with Carbanak Backdoor

FIN7 conducted a targeted spear-phishing campaign against a large U.S. automotive manufacturer using a fake IP-scanner site that redirected to a Dropbox-hosted executable (WsTaskLoad.exe) which deployed a multi-stage payload culminating in the Carbanak/Anunak backdoor; additional payloads (POWERTRASH) and persistence via OpenSSH were observed, but the infection was detected and the affected system removed before lateral movement or confirmed ransomware deployment.