ExCobalt

ExCobalt is a threat actor conducting campaigns against Russian organizations. Reported targeting includes Russian entities broadly, and the activity has been described as affecting Russian organizations through exploitation of known security flaws and the use of credentials stolen from contractors to obtain initial access. Positive Technologies described ExCobalt as one of the most dangerous groups attacking Russian entities. Observed ExCobalt-associated activity includes attempts to steal Telegram credentials and message history from compromised hosts, theft of Outlook Web Access credentials via malicious code injected into the login page, and use of the CobInt backdoor. Associated tooling and payloads include lockers such as Babuk and LockBit, the PUMAKIT kernel rootkit for privilege escalation and stealth, and the Rust-based Octopus toolkit for privilege elevation on compromised Linux systems. Positive Technologies reported that ExCobalt shifted initial access from exploiting 1-day vulnerabilities in internet-exposed corporate services such as Microsoft Exchange to penetrating primary targets through contractors. The content also states that Shedding Zmiy is a group associated with the (Ex)Cobalt activity cluster, indicating a relationship between Shedding Zmiy and ExCobalt. The alias directly provided in the source is "excobalt."