# Fin7 Carbanak

Adversary-emulation profile for FIN7 (G0046; aka Carbanak, Carbon Spider, Sangria...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill fin7-carbanak -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill fin7-carbanak -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill fin7-carbanak -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill fin7-carbanak -g -a gemini-cli -y`

## Description

Adversary-emulation profile for FIN7 (G0046; aka Carbanak, Carbon Spider, Sangria Tempest, GOLD NIAGARA, ELBRUS) \u2014 a financially motivated Russian-speaking crime group, mapping its TTPs to Decepticon tooling for authorized red-team emulation.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# FIN7 (Carbanak, Carbon Spider, Sangria Tempest), Adversary Emulation Profile

FIN7 (MITRE ATT&CK **G0046**; also tracked as Carbanak, Carbon Spider, Sangria Tempest, GOLD NIAGARA, ELBRUS, and ITG14) is one of the most prolific and best-documented financially motivated cybercrime groups, active since at least 2013. Originally infamous for large-scale point-of-sale (POS) intrusions to steal payment-card data, operating behind the front company "Combi Security", the group pivoted to "big game hunting" ransomware around 2020, running its own Darkside/BlackMatter Ransomware-as-a-Service and acting as an affiliate/tooling supplier for REvil, Cl0p, Black Basta, ALPHV/BlackCat, LockBit, and others. FIN7 is characterized by disciplined operational tradecraft: convincing social engineering (including spearphishing of IT staff and physically mailed BadUSB drives), heavily obfuscated custom loaders (POWERTRASH), signature backdoors (Carbanak/Anunak, Lizar/Diceloader), purchased/cracked commercial tooling (Cobalt Strike, Core Impact), and a productized EDR-killer (AvNeutralizer/AuKill) sold on criminal forums.

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/fin7-carbanak/SKILL.md