Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions. This threat group has conducted intrusions to steal money by targeting ATM, card processing, payment, and SWIFT systems. Cobalt Group has primarily targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. This group has targeted organizations to use their access to compromise additional victims. Reporting indicates there may be links between Cobalt Group and the malware Carbanak and threat group Carbanak.
Other names for this threat
Cobalt, Cobalt Gang, Cobalt Spider, GOLD KINGSWOOD
The following is a collection of rules based on the presence of indicators of compromise publicly reported as associated with this malicious actor.