Cobalt Group
Cobalt Group
Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions. This threat group has conducted intrusions to steal money by targeting ATM, card processing, payment, and SWIFT systems. Cobalt Group has primarily targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. This group has targeted organizations to use their access to compromise additional victims. Reporting indicates there may be links between Cobalt Group and the malware Carbanak and threat group Carbanak.
Other names for this threat
Cobalt, Cobalt Gang, Cobalt Spider, GOLD KINGSWOOD
The following is a collection of rules based on the presence of indicators of compromise publicly reported as associated with this malicious actor.
Suspicious DNS Request - Cobalt group Related Domain Observed
Description
This detection identifies a request to resolve a domain publicly reported as associated with this malicious actor. Malicious actors may use compromised websites for malicious purposes. This detection is powered by the Rapid7 Digital Risk Protection (Threat Command) Threat Library.
Recommendation
This alert may have been caused by normal web browsing activity by the end user. Review the alert in question. If necessary, rebuild the host from a known, good source and have the user change their password.
MITRE ATT&CK Techniques
- Acquire Infrastructure - T1583
- Domains - T1583.001
- Compromise Infrastructure - T1584
- Domains - T1584.001
Suspicious Process - Cobalt group Related Binary Executed
Description
This detection identifies the execution of a file with a hash publicly reported as associated with this malicious actor. Malicious actors may use common System Administration tools for malicious purposes. This detection is powered by the Rapid7 Digital Risk Protection (Threat Command) Threat Library.
Recommendation
Review the alert in question. If necessary, rebuild the host from a known, good source and have the user change their password.
Suspicious Web Request - Cobalt group Related Domain Observed
Description
This detection identifies a request to a domain publicly reported as associated with this malicious actor. Malicious actors may compromise websites for malicious purposes. This detection is powered by the Rapid7 Digital Risk Protection (Threat Command) Threat Library.
Recommendation
This alert may have been caused by normal web browsing activity by the end user. Review the alert in question. If necessary, rebuild the host from a known, good source and have the user change their password.
MITRE ATT&CK Techniques
- Acquire Infrastructure - T1583
- Domains - T1583.001
- Virtual Private Server - T1583.003
- Server - T1583.004
- Compromise Infrastructure - T1584
- Domains - T1584.001
- Virtual Private Server - T1584.003
- Server - T1584.004