In the evolving landscape of cyber threats, the notorious APT group FIN7, also known as Carbanak, has adapted its tactics. Previously infamous for direct bank heists, FIN7 is now targeting point-of-sale (POS) systems across retail sectors. Leveraging legitimate penetration testing tools for illicit purposes, this operation requires analysts to trace the evolution of the malware and adapt their defensive strategies. Participants will investigate a series of alerts that reveal FIN7's cunning shift in tactics.