Introduction
Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims. Talos Cobalt Group July 2018 PTSecurity Cobalt Group Aug 2017 PTSecurity Cobalt Dec 2016 Group IB Cobalt Aug 2017 Proofpoint Cobalt June 2017 RiskIQ Cobalt Nov 2017 RiskIQ Cobalt Jan 2018 Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak. Europol Cobalt Mar 2018
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1566.001 Spearphishing Attachment
- T1105 Ingress Tool Transfer
- T1027.010 Command Obfuscation
- T1053.005 Scheduled Task
- T1218.008 Odbcconf
- T1195.002 Compromise Software Supply Chain
- T1518.001 Security Software Discovery
- T1559.002 Dynamic Data Exchange
- T1204.002 Malicious File
- T1068 Exploitation for Privilege Escalation
- T1218.003 CMSTP
- T1218.010 Regsvr32
- T1055 Process Injection
- T1059.001 PowerShell
- T1588.002 Tool
- T1021.001 Remote Desktop Protocol
- T1059.005 Visual Basic
- T1203 Exploitation for Client Execution
- T1070.004 File Deletion
- T1548.002 Bypass User Account Control
- T1220 XSL Script Processing
- T1071.004 DNS
- T1059.007 JavaScript
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1059.003 Windows Command Shell
- T1071.001 Web Protocols
- T1547.001 Registry Run Keys / Startup Folder
- T1572 Protocol Tunneling
- T1573.002 Asymmetric Cryptography
- T1543.003 Windows Service
- T1219 Remote Access Tools
- T1046 Network Service Discovery
- T1037.001 Logon Script (Windows)
ATT&CK technique IDs (denormalized)
- T1021.001
- T1027.010
- T1037.001
- T1046
- T1053.005
- T1055
- T1059.001
- T1059.003
- T1059.005
- T1059.007
- T1068
- T1070.004
- T1071.001
- T1071.004
- T1105
- T1195.002
- T1203
- T1204.001
- T1204.002
- T1218.003
- T1218.008
- T1218.010
- T1219
- T1220
- T1518.001
- T1543.003
- T1547.001
- T1548.002
- T1559.002
- T1566.001
- T1566.002
- T1572
- T1573.002
- T1588.002
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
- Mimikatz (S0002) — tool
- More_eggs (S0284) — malware
- SpicyOmelette (S0646) — malware
- SDelete (S0195) — tool
- Cobalt Strike (S0154) — malware
- PsExec (S0029) — tool
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [6] Crowdstrike Global Threat Report Feb 2018 CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018. [7] Secureworks GOLD KINGSWOOD September 2018 CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021. [8] Europol Cobalt Mar 2018 Europol. (2018, March 26). Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested in Spain. Retrieved October 10, 2018. [9] Morphisec Cobalt Gang Oct 2018 Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018. [10] RiskIQ Cobalt Nov 2017 Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018. [11] RiskIQ Cobalt Jan 2018 Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018. [12] Group IB Cobalt Aug 2017 Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018. [13] Proofpoint Cobalt June 2017 Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018. [14] PTSecurity Cobalt Dec 2016 Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018. [15] PTSecurity Cobalt Group Aug 2017 Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018. [16] Talos Cobalt Group July 2018 Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.