CybercrimeMITRE G0080
Cobalt
Also known as Cobalt Group, Cobalt Gang, GOLD KINGSWOOD, COBALT SPIDER, G0080, Mule Libra
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1021.001 Remote Desktop ProtocolT1027.010 Command ObfuscationT1037.001 Logon Script (Windows)T1046 Network Service DiscoveryT1053.005 Scheduled TaskT1055 Process InjectionT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.007 JavaScriptT1068 Exploitation for Privilege EscalationT1070.004 File DeletionT1071.001 Web ProtocolsT1071.004 DNST1105 Ingress Tool TransferT1195.002 Compromise Software Supply ChainT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1218.003 CMSTPT1218.008 OdbcconfT1218.010 Regsvr32T1219 Remote Access ToolsT1220 XSL Script ProcessingT1518.001 Security Software DiscoveryT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account ControlT1559.002 Dynamic Data ExchangeT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1572 Protocol TunnelingT1573.002 Asymmetric CryptographyT1588.002 Tool
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/
- https://www.bleepingcomputer.com/news/security/cobalt-hacking-group-tests-banks-in-russia-and-romania/
- https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish
- https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-september-cobalt-spider/
- https://www.group-ib.com/blog/cobalt
- https://www.reuters.com/article/us-taiwan-cyber-atms/taiwan-atm-heist-linked-to-european-hacking-spree-security-firm-idUSKBN14P0CX
- https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target
- https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/
- https://www.riskiq.com/blog/labs/cobalt-strike/
- https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/
- https://unit42.paloaltonetworks.com/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/
- https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.