CobaltThreat actor
- Cobalt Gang
- Cobalt Group
- cobalt spider
- g0080
- gold kingswood
- mule libra
A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.From MISP Galaxy
Last reported 3 months ago, by Recorded Future5 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1566.001Spearphishing Attachment
“Let’s start from the Initial Access tactic (TA0001) and the most common technique – Spearphishing Attachment (T1193).”
- T1027Obfuscated Files or Information
“T1027”
- T1047Windows Management Instrumentation
“T1047”
- T1204User Execution
“T1204”
- T1218.001Compiled HTML File
“Here another interesting technique – Compiled HTML File (T1223).”
- T1546.011Application Shimming
“Next tactics – Persistence (TA0001) and Privilege Escalation (TA0004), and Application Shimming (T1138) as an example.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
TAG-195 Upgrades MaaS Ecosystem with Modular Tools“Public reporting by eSentire has previously linked TAG-195 tooling to FIN6, Cobalt Group, and Evilnum, three financially motivated criminal groups, suggesting the ecosystem serves a select customer base; however, details on sales models and access conditions remain unknown.”
-
A Shortcut to Compromise: Cobalt Gang phishing campaign“A Shortcut to Compromise: Cobalt Gang phishing campaign”
-
Hunting for Attacker’s Tactics and Techniques With Prefetch Files“A good example is Cobalt Group.”
-
Cobalt Renaissance“This report publicly discloses the joint operations of the Cobalt Group and Anunak (Carbanak) which were identified privately before arrests, and provides an overview of their key attacks in the period 2016 – 2017.”
-
When Hackers are Quicker than Antiviruses: Cobalt Group Bypasses Antivirus Protection“When Hackers are Quicker than Antiviruses: Cobalt Group Bypasses Antivirus Protection”
Indicators in its reports
named in the reports above- swift-customer[.]comin 1 report
- e85a079f9e48216e…139677ec3c9fin 1 report
- 76a5a477927a4b8c…fb62afa41a98in 1 report
- valorleads[.]comin 1 report
- 1fdc309f8ff96ebb…7a91165e0b5fin 1 report
- hxxps://image.isu[.]pub/130729032316-97fbf070197fbde8e88397077c468ab6/jpg/page_1.jpgin 1 report
- image.isu[.]pubin 1 report
- hxxp://safestaticfirefox[.]com/uacuxuiaeoerkaryixjuin 1 report
- safestaticfirefox[.]comin 1 report
- ccleaner64.exe-de05dbe1[.]pfin 1 report
- kaspersky-corporate[.]comin 1 report
- 172.217.22[.]110in 1 report
- 194.58.112[.]174in 1 report
- 62.76.40[.]207in 1 report
- mail.kaspersky-corporate[.]comin 1 report
- hxxps://kaspersky-security[.]com/Complaint.docin 1 report
- kaspersky-security[.]comin 1 report
- fa354151a3fc6d0dce69e8eeaa8cd197in 1 report
- 91.230.121[.]86in 1 report
- 7b55c7ae346efb428aaf63d25ca0fcc7in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.