CobInt
CobInt is a backdoor/loader used in intrusions targeting Russian organizations. The provided reporting links its use to multiple threat clusters, including Twelve, Head Mare, Crypt Ghouls, and ExCobalt/Shedding Zmiy-related activity. It has been used for remote access to domain controllers and as a follow-on exploitation tool in campaigns against Russian companies, government agencies, and sectors including manufacturing, energy, mining, finance, retail, and other state and private-sector entities.
Observed delivery and execution chains include a VBScript downloader/loader named Intellpui.vbs that executes obfuscated PowerShell to load CobInt into memory from a command-and-control server, and another loader chain using mcdrive.vbs and mcdrive.ps1, where mcdrive.ps1 acted as a CobInt loader contacting the C2 domain 360nvidia[.]com. In one incident, attackers exploited CVE-2021-26855 (ProxyLogon) on Microsoft Exchange Server to download and launch CobInt. Reporting also states CobInt connected to a command-and-control domain resolving to 45.156.27[.]115.
High-confidence indicators and artifacts directly mentioned in the content include Intellpui.vbs, mcdrive.vbs, mcdrive.ps1, the domain 360nvidia[.]com, and infrastructure resolving to 45.156.27[.]115. CobInt is specifically described as a known backdoor used by ExCobalt and as malware previously observed only in Twelve’s attacks before later use by Head Mare and Crypt Ghouls, making it a notable overlap point between these Russia-focused intrusion sets.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In one incident, they exploited the Microsoft Exchange server vulnerability CVE-2021-26855 (ProxyLogon). Although patched in 2021, this vulnerability is still exploitable due to organizations using outdated operating systems and software. The attackers used ProxyLogon to execute a command to download and launch CobInt on the server. | For instance, they used the CobInt backdoor for remote access to domain controllers, previously observed only in Twelve’s attacks on Russian companies.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For instance, they used the CobInt backdoor for remote access to domain controllers, previously observed only in Twelve’s attacks on Russian companies.
For instance, they used the CobInt backdoor for remote access to domain controllers, previously observed only in Twelve’s attacks on Russian companies.
In one Crypt Ghouls attack, we discovered a malicious CobInt backdoor loader.
In one Crypt Ghouls attack, we discovered a malicious CobInt backdoor loader.
...attempts to siphon Telegram credentials... and Outlook Web Access credentials... - CobInt, a known backdoor used by the group.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
...threat actors leveraging a contractor's login credentials to connect to the internal systems via VPN... weaponizing trusted relationships.
"...Outlook Web Access credentials by injecting malicious code into the login page..."
The attackers also exploited software vulnerabilities... In one incident, they exploited the Microsoft Exchange server vulnerability CVE-2021-26855 (ProxyLogon)... The attackers used ProxyLogon to execute a command to download and launch CobInt on the server.
Execution
2 techniques
Execution
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
1 technique
Stealth
Credential Access
1 technique
Credential Access
Collection
1 technique
Collection
IOCs tracked for this family
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor/loader delivered via the VBScript Intellpui.vbs, which executes obfuscated PowerShell to communicate with a C2 server and load the CobInt backdoor into memory.
Backdoor used by ExCobalt; associated activity includes credential theft from Telegram and Outlook Web Access via malicious code injection into the login page.
Backdoor/loader used to execute obfuscated PowerShell and load additional malware into memory (fileless/in-memory execution), reducing on-disk artifacts.
Backdoor used post-compromise to facilitate follow-on exploitation/remote control as part of the intrusion chain preceding ransomware deployment.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.