Introduction
Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims. Talos Cobalt Group July 2018 PTSecurity Cobalt Group Aug 2017 PTSecurity Cobalt Dec 2016 Group IB Cobalt Aug 2017 Proofpoint Cobalt June 2017 RiskIQ Cobalt Nov 2017 RiskIQ Cobalt Jan 2018 Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak. Europol Cobalt Mar 2018
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
Information pending cataloguing.
Attribution and Evidence
Information pending cataloguing.
References
[1] MITRE ATT&CK MITRE ATT&CK entry [2] Talos Cobalt Group July 2018 [3] PTSecurity Cobalt Group Aug 2017 [4] PTSecurity Cobalt Dec 2016 [5] Group IB Cobalt Aug 2017 [6] Proofpoint Cobalt June 2017 [7] RiskIQ Cobalt Nov 2017 [8] RiskIQ Cobalt Jan 2018 [9] Europol Cobalt Mar 2018