Cobalt
threat actor01
also known as
Other names and identifiers for this entity.
ATT&CK
Cobalt Gang · Cobalt Group · Cobalt Spider · GOLD KINGSWOOD
MISP
COBALT SPIDER · Cobalt · Cobalt Gang · Cobalt Group · GOLD KINGSWOOD · Mule Libra
A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.
02
resolved ATT&CK groups
Threat groups associated with this.
03
techniques used (34)
ATT&CK techniques this enables or maps to.
showing 20 of 34
04
software used (6)
Malware and tools associated with this.
05
references
External citations — patches, advisories, analysis.
- https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/
- https://www.bleepingcomputer.com/news/security/cobalt-hacking-group-tests-banks-in-russia-and-romania/
- https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish
- https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-september-cobalt-spider/
- https://www.group-ib.com/blog/cobalt
- https://www.reuters.com/article/us-taiwan-cyber-atms/taiwan-atm-heist-linked-to-european-hacking-spree-security-firm-idUSKBN14P0CX
- https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target
- https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/