Cybersecurity

FIN7

FIN7 (Carbon Spider / Sangria Tempest) adversary-emulation playbook — revenue-targeted spearphishing with phone follow-up, EDR-evasion tradecraft, AD compromise, and big-game-hunting ransomware. Use when emulating a high-end financially-motivated crew that graduated from POS theft to ransomware. Triggers on: 'emulate FIN7', 'Carbanak', 'Carbon Spider', 'Sangria Tempest', 'big game hunting', 'EDR evasion', 'AvNeutralizer'.

Publisher / source

BitterSecurity/Decepticon (found on GitHub top repositories)

Upstream record

BitterSecurity/Decepticon

Version

Version 1

Published

2026-11-04

Publication review

Approved for publication · recorded passed scan 2026-11-04

Content fingerprint

37935248d663ee5894b59570d25db5356cc3ee95c139a8864bb59c960f262a2b