MITRE ATT&CKgroup
G0080 Cobalt Group
- Domain
- enterprise
- Aliases
- GOLD KINGSWOOD, Cobalt Gang, Cobalt Spider
- Version
- 2.1
- Created
- 2018-10-17
Description
Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims. Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak.
Related
Uses · MITRE ATT&CK (40)
- T1027.010 Command Obfuscation sub-technique
- S0646 SpicyOmelette software (malware)
- T1588.002 Tool sub-technique
- T1059.007 JavaScript sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.004 DNS sub-technique
- T1572 Protocol Tunneling technique
- T1195.002 Compromise Software Supply Chain sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1559.002 Dynamic Data Exchange sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1070.004 File Deletion sub-technique
- T1548.002 Bypass User Account Control sub-technique
- T1218.008 Odbcconf sub-technique
- T1218.003 CMSTP sub-technique
- T1218.010 Regsvr32 sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1037.001 Logon Script (Windows) sub-technique
- T1053.005 Scheduled Task sub-technique
- S0284 More_eggs software (malware)
- T1220 XSL Script Processing technique
References
- https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report Crowdstrike Global Threat Report Feb 2018
- https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish Secureworks GOLD KINGSWOOD September 2018
- https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain Europol Cobalt Mar 2018
- https://blog.morphisec.com/cobalt-gang-2.0 Morphisec Cobalt Gang Oct 2018
- https://web.archive.org/web/20190508170630/https://www.riskiq.com/blog/labs/cobalt-strike/ RiskIQ Cobalt Nov 2017
- https://web.archive.org/web/20190508170147/https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/ RiskIQ Cobalt Jan 2018
- https://www.group-ib.com/blog/cobalt Group IB Cobalt Aug 2017
- https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target Proofpoint Cobalt June 2017
- https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf PTSecurity Cobalt Dec 2016
- https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf PTSecurity Cobalt Group Aug 2017
- https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html Talos Cobalt Group July 2018