Cobalt Group
Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims. Reporting indicates there may be links between…
- ATT&CK ID
- G0080
- Techniques
- 26
- Tools
- 6
Also tracked as GOLD KINGSWOOD · Cobalt Gang · Cobalt Spider
Vulnerabilities it has exploited
- CVE-2017-0199 Microsoft Office and WordPadUnscored · exploited in the wild
- CVE-2017-11882 Microsoft OfficeUnscored · exploited in the wild
- CVE-2017-8570 Microsoft OfficeUnscored · exploited in the wild
- CVE-2017-8759 Microsoft .NET FrameworkUnscored · exploited in the wild
- CVE-2018-8174 Microsoft WindowsUnscored · exploited in the wild
Techniques
Resource Development
Initial Access
Supply Chain CompromisePhishing
Execution
Scheduled Task/JobCommand and Scripting InterpreterExploitation for Client ExecutionUser ExecutionInter-Process Communication
Persistence
Boot or Logon Initialization ScriptsScheduled Task/JobCreate or Modify System ProcessBoot or Logon Autostart Execution
Privilege Escalation
Boot or Logon Initialization ScriptsScheduled Task/JobProcess InjectionExploitation for Privilege EscalationCreate or Modify System ProcessBoot or Logon Autostart ExecutionAbuse Elevation Control Mechanism
Stealth
Obfuscated Files or InformationProcess InjectionIndicator RemovalSystem Binary Proxy ExecutionXSL Script Processing
Discovery
Network Service DiscoverySoftware Discovery
Lateral Movement
Command and Control
Application Layer ProtocolIngress Tool TransferRemote Access ToolsProtocol TunnelingEncrypted Channel
Software
Cobalt Strike · Mimikatz · More_eggs · PsExec · SDelete · SpicyOmelette