Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims.1234567 Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak.8
- Talos Cobalt Group July 2018
- PTSecurity Cobalt Group Aug 2017
- PTSecurity Cobalt Dec 2016
- Group IB Cobalt Aug 2017
- Proofpoint Cobalt June 2017
- RiskIQ Cobalt Nov 2017
- RiskIQ Cobalt Jan 2018
- Europol Cobalt Mar 2018
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Cobalt Group | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | GOLD KINGSWOOD | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Cobalt Gang | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Cobalt Spider | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.008 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1220 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1021.001 | Remote Desktop Protocol | — |
| T1027.010 | Command Obfuscation | — |
| T1037.001 | Logon Script (Windows) | — |
| T1046 | Network Service Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1055 | Process Injection | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.007 | JavaScript | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1071.004 | DNS | — |
| T1105 | Ingress Tool Transfer | — |
| T1195.002 | Compromise Software Supply Chain | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.003 | CMSTP | — |
| T1218.008 | Odbcconf | — |
| T1218.010 | Regsvr32 | — |
| T1219 | Remote Access Tools | — |
| T1220 | XSL Script Processing | — |
| T1518.001 | Security Software Discovery | — |
| T1543.003 | Windows Service | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1548.002 | Bypass User Account Control | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1572 | Protocol Tunneling | — |
| T1573.002 | Asymmetric Cryptography | — |
| T1588.002 | Tool | — |
别名
Cobalt Gang · Cobalt Group · Cobalt Spider · GOLD KINGSWOOD
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。