Loading threat actor…
ExCobalt is a threat cluster associated with campaigns targeting Russian organizations. It has been described as a highly dangerous actor operating against Russian entities and is linked in some reporting to Shedding Zmiy. The group has used known vulnerabilities and credentials stolen from contractors to obtain initial access, reflecting a pattern of exploiting trusted third-party relationships as well as exposed enterprise services. Observed ExCobalt tradecraft includes credential theft and post-compromise collection focused on communications platforms, including attempts to steal Telegram credentials and message history and to capture Outlook Web Access credentials through malicious code injection into login pages. Tooling associated with the cluster includes the CobInt backdoor, lockers such as Babuk and LockBit, and Linux privilege-escalation tooling including Octopus. Reporting also links ExCobalt-associated activity to PUMAKIT, a kernel rootkit used to escalate privileges and hide files and directories, with earlier related iterations referred to as Facefish, Kitsune, and Megatsune. ExCobalt has been associated with intrusion activity against Russian organizations through both direct exploitation and contractor-mediated access. Its operations show capabilities spanning initial access, credential theft, privilege escalation, persistence, defense evasion, and post-exploitation. Use of ransomware lockers has been observed, but the available information does not firmly establish a distinct extortion model for the cluster.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Activity cluster whose members may be participating in overlapping campaigns targeting Russian organizations; associated here through Shedding Zmiy and shared tooling/infrastructure patterns.
Campaigns targeting Russian organizations using exploitation of known vulnerabilities and use of stolen credentials.
Targets Russian organizations; gains initial access by exploiting known vulnerabilities and using contractor-stolen credentials; conducts credential theft (Telegram/OWA) and uses a mix of backdoors, rootkits, and ransomware lockers.
Targets Russian organizations; gains initial access via exploitation of known vulnerabilities and use of contractor-stolen credentials; conducts credential theft (Telegram and OWA) and uses a mix of backdoors, rootkits, and ransomware lockers.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.