LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0080: Cobalt Group

MITRE ATT&CK G0080: Cobalt Group Group details, with detection guidance, relationships and mapped CVEs.

EnterpriseG0080GroupObject v2.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Cobalt Group matters because ATT&CK describes it as a financially motivated intrusion set focused on stealing money from financial institutions, including through ATM, card processing, payment, and SWIFT-related environments. For executives and security leaders, the decision value is not the name itself; it is whether the organization can prove that high-value financial transaction systems, identity paths, and third-party access routes are monitored and recoverable if an intrusion reaches money movement infrastructure.

Executive priority

Prioritize this as a financial-fraud and business-continuity scenario for banks and organizations connected to financial transaction ecosystems. Leaders should ask whether critical payment operations have segmented access, accountable privileged activity, incident-response playbooks for transaction manipulation or unauthorized money movement, and audit-ready evidence showing monitoring around ATM, card processing, payment, and SWIFT systems where applicable. Because ATT&CK notes the group has used access to compromise additional victims, supplier, partner, and downstream access governance should also be part of the risk discussion.

Technical view

ATT&CK provides no platform, tactic, technique, relationship, or detection details for this object in the supplied data, so SOC and IR teams should not infer specific procedures from this record alone. Use the object as a threat-intelligence driver to validate defensive coverage around financial transaction environments: authentication paths into payment systems, administrative access to ATM/card/SWIFT-related infrastructure, unusual remote access, lateral movement indicators in sensitive network zones, and evidence of systems being used as a staging point to reach other victims. Any detection engineering should be grounded in local architecture and additional source reporting, not this group record by itself.

Likely telemetry

  • Privileged authentication and authorization logs for financial transaction systems
  • Administrative activity logs for ATM, card processing, payment, and SWIFT-related environments where present
  • Network flow and remote access telemetry between user, server, and sensitive financial operations zones
  • Endpoint and server security telemetry for systems supporting payment operations
  • Change-management, transaction-processing, and application logs that can evidence unauthorized operational changes

Detection direction

  • Validate that monitoring exists around money movement infrastructure rather than only corporate IT endpoints.
  • Correlate privileged access, remote access, and network movement into sensitive financial system zones with approved change windows and business processes.
  • Treat detections involving payment, ATM, card processing, or SWIFT-related systems as higher priority because the described objective is direct financial theft.
  • Look for evidence that internal access could be used to reach additional victims, such as unusual outbound connections, partner-facing access, or abuse of trusted connectivity.
  • Avoid building group-specific detections from this object alone; the supplied ATT&CK record does not provide techniques, malware relationships, platforms, or official detection logic.

Mitigation priorities

  • Identify and inventory systems that support ATM, card processing, payment, and SWIFT operations, then map privileged access paths to them.
  • Enforce strong identity controls, least privilege, and reviewable administrative access for sensitive financial operations environments.
  • Segment financial transaction infrastructure from general enterprise networks and tightly govern remote and third-party access.
  • Maintain incident-response playbooks for suspected unauthorized transaction activity, including evidence preservation, containment, business approval paths, and regulator or partner notification workflows where applicable.
  • Use threat-intelligence enrichment and local incident data to decide whether additional controls or detections are needed beyond what this sparse ATT&CK object supports.
Additional notes and limits

The supplied ATT&CK description identifies Cobalt Group as financially motivated, primarily targeting financial institutions since at least 2016, with reported targeting of ATM, card processing, payment, and SWIFT systems, mainly in Eastern Europe, Central Asia, and Southeast Asia. It also notes aliases and reported links to Carbanak malware and the Carbanak group, but no relationship objects were supplied here, so those links should be treated as contextual description rather than relationship-driven evidence in this take.

No official detection, platforms, tactics, techniques, external references, or relationship context were supplied. This take therefore stays at the defensive-planning and validation level and does not assert specific tools, procedures, active campaigns, affected customers, or guaranteed detection coverage. Local architecture and additional intelligence are required for operational detection content.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Cobalt Group

No official description is available in the imported ATT&CK source object.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

34 rows
DomainIDNameRelationship / procedure
EnterpriseT1566.001Spearphishing AttachmentSub-techniqueThis object uses Spearphishing Attachment.
EnterpriseT1105Ingress Tool TransferThis object uses Ingress Tool Transfer.
EnterpriseT1027.010Command ObfuscationSub-techniqueThis object uses Command Obfuscation.
EnterpriseT1053.005Scheduled TaskSub-techniqueThis object uses Scheduled Task.
EnterpriseT1218.008OdbcconfSub-techniqueThis object uses Odbcconf.
EnterpriseT1195.002Compromise Software Supply ChainSub-techniqueThis object uses Compromise Software Supply Chain.
EnterpriseT1518.001Security Software DiscoverySub-techniqueThis object uses Security Software Discovery.
EnterpriseT1559.002Dynamic Data ExchangeSub-techniqueThis object uses Dynamic Data Exchange.
EnterpriseT1204.002Malicious FileSub-techniqueThis object uses Malicious File.
EnterpriseT1068Exploitation for Privilege EscalationThis object uses Exploitation for Privilege Escalation.
EnterpriseT1218.003CMSTPSub-techniqueThis object uses CMSTP.
EnterpriseT1218.010Regsvr32Sub-techniqueThis object uses Regsvr32.
EnterpriseT1055Process InjectionThis object uses Process Injection.
EnterpriseT1059.001PowerShellSub-techniqueThis object uses PowerShell.
EnterpriseT1588.002ToolSub-techniqueThis object uses Tool.
EnterpriseT1021.001Remote Desktop ProtocolSub-techniqueThis object uses Remote Desktop Protocol.
EnterpriseT1059.005Visual BasicSub-techniqueThis object uses Visual Basic.
EnterpriseT1203Exploitation for Client ExecutionThis object uses Exploitation for Client Execution.
EnterpriseT1070.004File DeletionSub-techniqueThis object uses File Deletion.
EnterpriseT1548.002Bypass User Account ControlSub-techniqueThis object uses Bypass User Account Control.
EnterpriseT1220XSL Script ProcessingThis object uses XSL Script Processing.
EnterpriseT1071.004DNSSub-techniqueThis object uses DNS.
EnterpriseT1059.007JavaScriptSub-techniqueThis object uses JavaScript.
EnterpriseT1566.002Spearphishing LinkSub-techniqueThis object uses Spearphishing Link.
EnterpriseT1204.001Malicious LinkSub-techniqueThis object uses Malicious Link.
EnterpriseT1059.003Windows Command ShellSub-techniqueThis object uses Windows Command Shell.
EnterpriseT1071.001Web ProtocolsSub-techniqueThis object uses Web Protocols.
EnterpriseT1547.001Registry Run Keys / Startup FolderSub-techniqueThis object uses Registry Run Keys / Startup Folder.
EnterpriseT1572Protocol TunnelingThis object uses Protocol Tunneling.
EnterpriseT1573.002Asymmetric CryptographySub-techniqueThis object uses Asymmetric Cryptography.
EnterpriseT1543.003Windows ServiceSub-techniqueThis object uses Windows Service.
EnterpriseT1219Remote Access ToolsThis object uses Remote Access Tools.
EnterpriseT1046Network Service DiscoveryThis object uses Network Service Discovery.
EnterpriseT1037.001Logon Script (Windows)Sub-techniqueThis object uses Logon Script (Windows).
Associated objects

Groups, software, and campaigns

ToolEnterprise

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows
MalwareEnterprise

S0284: More_eggs

More_eggs is a JScript backdoor used by Cobalt Group and FIN6. Its name was given based on the variable "More_eggs" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4. [1][2]

Windows
ToolEnterprise

S0195: SDelete

SDelete is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. [1]

Windows
MalwareEnterprise

S0154: Cobalt Strike

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]

In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]

LinuxmacOSWindows
ToolEnterprise

S0029: PsExec

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.[1][2]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1218.008: OdbcconfEnterpriseuses · TechniqueT1195.002: Compromise Software Supply ChainEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · ToolS0002: MimikatzEnterpriseuses · TechniqueT1559.002: Dynamic Data ExchangeEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1068: Exploitation for Privilege EscalationEnterpriseuses · TechniqueT1218.003: CMSTPEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1588.002: ToolEnterpriseuses · TechniqueT1021.001: Remote Desktop ProtocolEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1203: Exploitation for Client ExecutionEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1220: XSL Script ProcessingEnterpriseuses · TechniqueT1071.004: DNSEnterpriseuses · TechniqueT1059.007: JavaScriptEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.1
Created
Modified
Raw hash
c812e58a8612e3d9...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.1Current bundlec812e58a8612…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  2. [2]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  3. [3]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  4. [4]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  5. [5]
    Proofpoint Cobalt June 2017

    Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  6. [6]
    RiskIQ Cobalt Nov 2017

    Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  7. [7]
    RiskIQ Cobalt Jan 2018

    Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.

    Open source URL
  8. [8]
    Europol Cobalt Mar 2018

    Europol. (2018, March 26). Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested in Spain. Retrieved October 10, 2018.

    Open source URL
  9. [9]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  10. [10]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  11. [11]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  12. [12]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  13. [13]
    Crowdstrike Global Threat Report Feb 2018

    CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.

    Open source URL
  14. [14]
    Secureworks GOLD KINGSWOOD September 2018

    CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.

    Open source URL
  15. [15]
    Cobalt Gang

    (Citation: Talos Cobalt Group July 2018) (Citation: Crowdstrike Global Threat Report Feb 2018)(Citation: Morphisec Cobalt Gang Oct 2018)

  16. [16]
    Cobalt Gang

    (Citation: Talos Cobalt Group July 2018) (Citation: Crowdstrike Global Threat Report Feb 2018)(Citation: Morphisec Cobalt Gang Oct 2018)

  17. [17]
    Cobalt Gang

    (Citation: Talos Cobalt Group July 2018) (Citation: Crowdstrike Global Threat Report Feb 2018)(Citation: Morphisec Cobalt Gang Oct 2018)

  18. [18]
    Cobalt Group

    (Citation: Talos Cobalt Group July 2018) (Citation: PTSecurity Cobalt Group Aug 2017) (Citation: PTSecurity Cobalt Dec 2016) (Citation: Proofpoint Cobalt June 2017) (Citation: RiskIQ Cobalt Nov 2017) (Citation: RiskIQ Cobalt Jan 2018)

  19. [19]
    Cobalt Group

    (Citation: Talos Cobalt Group July 2018) (Citation: PTSecurity Cobalt Group Aug 2017) (Citation: PTSecurity Cobalt Dec 2016) (Citation: Proofpoint Cobalt June 2017) (Citation: RiskIQ Cobalt Nov 2017) (Citation: RiskIQ Cobalt Jan 2018)

  20. [20]
    Cobalt Group

    (Citation: Talos Cobalt Group July 2018) (Citation: PTSecurity Cobalt Group Aug 2017) (Citation: PTSecurity Cobalt Dec 2016) (Citation: Proofpoint Cobalt June 2017) (Citation: RiskIQ Cobalt Nov 2017) (Citation: RiskIQ Cobalt Jan 2018)

  21. [21]
    Cobalt Spider

    (Citation: Crowdstrike Global Threat Report Feb 2018)

  22. [22]
    Cobalt Spider

    (Citation: Crowdstrike Global Threat Report Feb 2018)

  23. [23]
    Cobalt Spider

    (Citation: Crowdstrike Global Threat Report Feb 2018)

  24. [24]
    Crowdstrike Global Threat Report Feb 2018

    CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.

    Open source URL
  25. [25]
    Crowdstrike Global Threat Report Feb 2018

    CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.

    Open source URL
  26. [26]
    Europol Cobalt Mar 2018

    Europol. (2018, March 26). Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested in Spain. Retrieved October 10, 2018.

    Open source URL
  27. [27]
    Europol Cobalt Mar 2018

    Europol. (2018, March 26). Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested in Spain. Retrieved October 10, 2018.

    Open source URL
  28. [28]
    GOLD KINGSWOOD

    (Citation: Secureworks GOLD KINGSWOOD September 2018)

  29. [29]
    GOLD KINGSWOOD

    (Citation: Secureworks GOLD KINGSWOOD September 2018)

  30. [30]
    GOLD KINGSWOOD

    (Citation: Secureworks GOLD KINGSWOOD September 2018)

  31. [31]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  32. [32]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  33. [33]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  34. [34]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  35. [35]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  36. [36]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  37. [37]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  38. [38]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  39. [39]
    Proofpoint Cobalt June 2017

    Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  40. [40]
    Proofpoint Cobalt June 2017

    Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  41. [41]
    RiskIQ Cobalt Jan 2018

    Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.

    Open source URL
  42. [42]
    RiskIQ Cobalt Jan 2018

    Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.

    Open source URL
  43. [43]
    RiskIQ Cobalt Nov 2017

    Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  44. [44]
    RiskIQ Cobalt Nov 2017

    Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  45. [45]
    Secureworks GOLD KINGSWOOD September 2018

    CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.

    Open source URL
  46. [46]
    Secureworks GOLD KINGSWOOD September 2018

    CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.

    Open source URL
  47. [47]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  48. [48]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  49. [49]
    mitre-attackG0080
    Open source URL
  50. [50]
    mitre-attackG0080
    Open source URL
  51. [51]
    mitre-attackG0080
    Open source URL
  52. [52]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  53. [53]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  54. [54]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  55. [55]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  56. [56]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  57. [57]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  58. [58]
    Proofpoint Cobalt June 2017

    Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  59. [59]
    Proofpoint Cobalt June 2017

    Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  60. [60]
    RiskIQ Cobalt Nov 2017

    Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  61. [61]
    RiskIQ Cobalt Nov 2017

    Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  62. [62]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  63. [63]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  64. [64]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  65. [65]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  66. [66]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  67. [67]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  68. [68]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  69. [69]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  70. [70]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  71. [71]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  72. [72]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  73. [73]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  74. [74]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  75. [75]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  76. [76]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  77. [77]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  78. [78]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  79. [79]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  80. [80]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  81. [81]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  82. [82]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  83. [83]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  84. [84]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  85. [85]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  86. [86]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  87. [87]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  88. [88]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  89. [89]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  90. [90]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  91. [91]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  92. [92]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  93. [93]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  94. [94]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  95. [95]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  96. [96]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  97. [97]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  98. [98]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  99. [99]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  100. [100]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  101. [101]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  102. [102]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  103. [103]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  104. [104]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  105. [105]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  106. [106]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  107. [107]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  108. [108]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  109. [109]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  110. [110]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  111. [111]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  112. [112]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  113. [113]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  114. [114]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  115. [115]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  116. [116]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  117. [117]
    RiskIQ Cobalt Jan 2018

    Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.

    Open source URL
  118. [118]
    RiskIQ Cobalt Jan 2018

    Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.

    Open source URL
  119. [119]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  120. [120]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  121. [121]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  122. [122]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  123. [123]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  124. [124]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  125. [125]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  126. [126]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  127. [127]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  128. [128]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  129. [129]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  130. [130]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  131. [131]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  132. [132]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  133. [133]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  134. [134]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  135. [135]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  136. [136]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  137. [137]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  138. [138]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  139. [139]
    Crowdstrike Global Threat Report Feb 2018

    CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.

    Open source URL
  140. [140]
    Crowdstrike Global Threat Report Feb 2018

    CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.

    Open source URL
  141. [141]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  142. [142]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  143. [143]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  144. [144]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  145. [145]
    Proofpoint Cobalt June 2017

    Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  146. [146]
    Proofpoint Cobalt June 2017

    Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  147. [147]
    RiskIQ Cobalt Jan 2018

    Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.

    Open source URL
  148. [148]
    RiskIQ Cobalt Jan 2018

    Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.

    Open source URL
  149. [149]
    RiskIQ Cobalt Nov 2017

    Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  150. [150]
    RiskIQ Cobalt Nov 2017

    Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  151. [151]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  152. [152]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  153. [153]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  154. [154]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  155. [155]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  156. [156]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  157. [157]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  158. [158]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  159. [159]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  160. [160]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  161. [161]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  162. [162]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  163. [163]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  164. [164]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  165. [165]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  166. [166]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  167. [167]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  168. [168]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  169. [169]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  170. [170]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  171. [171]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  172. [172]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  173. [173]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  174. [174]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  175. [175]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  176. [176]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  177. [177]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  178. [178]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  179. [179]
    Secureworks GOLD KINGSWOOD September 2018

    CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.

    Open source URL
  180. [180]
    Secureworks GOLD KINGSWOOD September 2018

    CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.

    Open source URL
  181. [181]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  182. [182]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  183. [183]
    Secureworks GOLD KINGSWOOD September 2018

    CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.

    Open source URL
  184. [184]
    Secureworks GOLD KINGSWOOD September 2018

    CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.

    Open source URL
  185. [185]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  186. [186]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  187. [187]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  188. [188]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  189. [189]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  190. [190]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  191. [191]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  192. [192]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  193. [193]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  194. [194]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
  195. [195]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  196. [196]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  197. [197]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  198. [198]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  199. [199]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  200. [200]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  201. [201]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  202. [202]
    Unit 42 Cobalt Gang Oct 2018

    Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.

    Open source URL
  203. [203]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  204. [204]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  205. [205]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  206. [206]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  207. [207]
    Secureworks GOLD KINGSWOOD September 2018

    CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.

    Open source URL
  208. [208]
    Secureworks GOLD KINGSWOOD September 2018

    CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.

    Open source URL
  209. [209]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  210. [210]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  211. [211]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  212. [212]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  213. [213]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  214. [214]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  215. [215]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  216. [216]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  217. [217]
    Crowdstrike Global Threat Report Feb 2018

    CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.

    Open source URL
  218. [218]
    Crowdstrike Global Threat Report Feb 2018

    CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.

    Open source URL
  219. [219]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  220. [220]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  221. [221]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  222. [222]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  223. [223]
    Proofpoint Cobalt June 2017

    Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  224. [224]
    Proofpoint Cobalt June 2017

    Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  225. [225]
    RiskIQ Cobalt Jan 2018

    Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.

    Open source URL
  226. [226]
    RiskIQ Cobalt Jan 2018

    Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.

    Open source URL
  227. [227]
    RiskIQ Cobalt Nov 2017

    Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  228. [228]
    RiskIQ Cobalt Nov 2017

    Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018.

    Open source URL
  229. [229]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  230. [230]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  231. [231]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  232. [232]
    TrendMicro Cobalt Group Nov 2017

    Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.

    Open source URL
  233. [233]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  234. [234]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  235. [235]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  236. [236]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  237. [237]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  238. [238]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  239. [239]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  240. [240]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  241. [241]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  242. [242]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  243. [243]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  244. [244]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  245. [245]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  246. [246]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  247. [247]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  248. [248]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  249. [249]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  250. [250]
    Group IB Cobalt Aug 2017

    Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.

    Open source URL
  251. [251]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  252. [252]
    PTSecurity Cobalt Group Aug 2017

    Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.

    Open source URL
  253. [253]
    Morphisec Cobalt Gang Oct 2018

    Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use