Sangria Tempest

Sangria Tempest, also known as FIN7, Carbon Spider, and ELBRUS, is a threat actor that has been active since 2014. This Russian advanced persistent threat (APT) group is known for its malicious activities, including spear-phishing campaigns, malware distribution, and theft of payment card data. In mid-November 2023, Microsoft observed Sangria Tempest utilizing Storm-1113’s EugenLoader delivered through malicious MSIX package installations. The actor frequently targets the restaurant industry, successfully stealing tens of millions of payment card data. They also deploy Carbanak, a backdoor used by the actor to deliver the Gracewire malware implant. Microsoft Threat Intelligence noted several actors—including Storm-0569, Storm-1113, Sangria Tempest, and Storm-1674—using App Installer as a point of entry for human-operated ransomware activity. Since mid-November 2023, these actors have been exploiting the ms-appinstaller URI scheme to distribute malware. Sangria Tempest was found to use Google ads to lure users into downloading malicious MSIX application packages, possibly relying on Storm-1113 infrastructure, leading to the delivery of POWERTRASH, a highly obfuscated PowerShell script. Another group tracked as Sangria Tempest used EugenLoader in November to drop its infamous Carbanak malware framework which then deployed the Gracewire implant. FIN7's activities were spotted and halted by BlackBerry's threat and research team in late 2023. The group targeted employees with high levels of administrative rights, but the cyber defenders detected the campaign early on, locating an infected system and isolating it before hackers had a chance to penetrate deeper into the network through lateral movement. Despite these measures, threat operations including Sangria Tempest exploited Microsoft's "ms-appinstaller protocol" for expediting Windows app installation to facilitate malware distribution, prompting the deactivation of the protocol.