Cobalt Group

Names and who uses them

• Cobalt GroupOur name
• Cobalt GangCisco Talos
• Cobalt SpiderCrowdStrike
• GOLD KINGSWOODSecureworks

Targets

Sectors: Finance

Regions: Europe, South East Asia, Central Asia

Known techniques

• T1021.001Remote Desktop Protocol
• T1027.010Command Obfuscation
• T1037.001Logon Script (Windows)
• T1046Network Service Discovery
• T1053.005Scheduled Task
• T1055Process Injection
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1059.007JavaScript
• T1068Exploitation for Privilege Escalation
• T1070.004File Deletion
• T1071.001Web Protocols
• T1071.004DNS
• T1105Ingress Tool Transfer
• T1195.002Compromise Software Supply Chain
• T1203Exploitation for Client Execution
• T1204.001Malicious Link
• T1204.002Malicious File
• T1218.003CMSTP
• T1218.008Odbcconf
• T1218.010Regsvr32
• T1219Remote Access Tools
• T1220XSL Script Processing
• T1518.001Security Software Discovery
• T1543.003Windows Service
• T1547.001Registry Run Keys / Startup Folder
• T1548.002Bypass User Account Control
• T1559.002Dynamic Data Exchange
• T1566.001Spearphishing Attachment
• T1566.002Spearphishing Link
• T1572Protocol Tunneling
• T1573.002Asymmetric Cryptography
• T1588.002Tool

Malware and tools used