Cobalt Group
Cobalt Group is a cybercriminal threat actor also referred to as Cobalt Gang, Cobalt Spider, and GOLD KINGSWOOD. The content describes GOLD KINGSWOOD as a financially motivated group that infiltrates the internal networks of financial institutions around the world and uses tactics more commonly associated with government-sponsored actors. Reported behavior includes sending phishing emails with malicious attachments that require victims to execute a file or enable a macro, using HTTPS for command and control, creating new Windows services for persistence, using Registry Run keys and a Startup path that launched PowerShell to download Cobalt Strike, executing JavaScript scriptlets on victim machines, and using the Plink utility to create SSH tunnels. The group is also associated in the content with use of Golden Chickens malware-as-a-service tooling. The provided material additionally notes that the same malware suite observed in TA4557 activity has also been seen with Cobalt Group and Evilnum, but tracks these as distinct activity clusters.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
48 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
21 malware families attributed to this actor across reporting.
16 additional families tracked in Mallory.
Associated vulnerabilities
8 CVEs this actor has used in observed campaigns. 8 of them exploited in the wild.
After the latest update, MWI is now using CVE-2017-0199 to launch an HTML Application (HTA) used for both information collection and payload execution.
...has exploited Office vulnerabilities such as CVE-2017-11882...
Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.
...exploited... CVE-2017-8759.
Cobalt Group had exploited... an Internet Explorer vulnerability (CVE-2018-8174)...
3 more CVEs tied to this actor tracked in Mallory.
Observables
35 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor for exploitation activity related to abuse of the Windows Cloud Files API / cldapi.dll detection.
Referenced in the detection annotations as a threat actor associated with exploitation for privilege escalation activity.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection.
Listed in the analytic annotations as a threat actor associated with exploitation for privilege escalation.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.