Cobalt Group

Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions. This threat group has conducted intrusions to steal money by targeting ATM, card processing, payment, and SWIFT systems. Cobalt Group has primarily targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. This group has targeted organizations to use their access to compromise additional victims. Reporting indicates there may be links between Cobalt Group and the malware Carbanak and threat group Carbanak.

Other names for this threat

Cobalt, Cobalt Gang, Cobalt Spider, GOLD KINGSWOOD

The following is a collection of rules based on the presence of indicators of compromise publicly reported as associated with this malicious actor.

This detection identifies a request to resolve a domain publicly known to be associated with this specific malicious actor. Please be aware that malicious actors will often use compromised legitimate websites for malicious purposes.

Recommendation

The alert may be related to normal web browsing activity by the end user. Review the alert in question. If necessary, rebuild the host from a known, good source and have the user change their password.

This detection identifies the execution of a file with a hash publicly known to be associated with this specific malicious actor. Please be aware that malicious actors will often use common System Administration tools for malicious purposes.

Recommendation

Review the alert in question. If necessary, rebuild the host from a known, good source and have the user change their password.

This detection identifies a request to a domain publicly known to be associated with this specific malicious actor. Please be aware that malicious actors will often compromise legitimate websites to use for malicious purposes.

Recommendation

The alert may be related to normal web browsing activity by the end user. Review the alert in question. If necessary, rebuild the host from a known, good source and have the user change their password.