Carbon Spider

CARBON SPIDER, also known as FIN7 and Sangria Tempest, is a threat actor that has been active in the eCrime space since approximately 2013. This criminally motivated group primarily targets the hospitality and retail sectors with the aim of obtaining payment card data. The group has been linked to several other cybercrime entities, including MUMMY SPIDER, NEMESIS KITTEN, and PROPHET SPIDER, each having their unique characteristics and methods of operation. Over time, CARBON SPIDER has demonstrated a capacity for innovation and adaptation, using various tools and techniques consistent with past FIN7 activity. From July 2023, CARBON SPIDER began exploiting MS Teams chats, using an open-source tool to distribute payloads and send phishing lures to facilitate the activities of another cybercrime group, Sangria Tempest. This group uses Storm-1113’s EugenLoader to drop Carbanak, which then delivers an implant called Gracewire. Alternatively, they have relied on Google ads to lure users into downloading malicious MSIX application packages from rogue landing pages to distribute POWERTRASH, which is then used to load NetSupport RAT and Gracewire. Another malware, JSSLoader, spread by Storm-0324, is also associated with this group. The access provided by these malwares allows the ransomware-as-a-service (RaaS) actor Sangria Tempest, also known as Carbon Spider, ELBRUS, and FIN7, to conduct post-exploitation actions and deploy file-encrypting malware. This highlights the complex and interconnected nature of the threats posed by these groups. Therefore, it is essential for organizations to maintain robust cybersecurity measures and be aware of the evolving tactics and techniques employed by these threat actors.