FIN7 Carbanak: Spear-Phish to Backdoor Intrusion

A macro-enabled Word attachment reached an accounting workstation at Valdoria Hotels Group. Within minutes the POWERTRASH backdoor was loaded, injected into a Windows system process, and beaconing to external infrastructure. Days of patient reconnaissance followed before the operator reached the financial server and deployed a custom tool against the SWIFT transaction interface. Reconstruct the full intrusion chain across endpoint, network, and perimeter telemetry.