Cobalt Group
Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims. [1] [2] [3] [4] [5] [6] [7] Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak. [8]
Associated Group Descriptions
Name | Description |
---|---|
Cobalt Gang | |
Cobalt Spider |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1548 | .002 | Abuse Elevation Control Mechanism: Bypass User Account Control |
Cobalt Group has bypassed UAC.[4] |
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
Cobalt Group has used HTTPS for C2.[1][3][4] |
.004 | Application Layer Protocol: DNS |
Cobalt Group has used DNS tunneling for C2.[1][3][4] |
||
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.[4] |
Enterprise | T1037 | .001 | Boot or Logon Initialization Scripts: Logon Script (Windows) |
Cobalt Group has added persistence by registering the file name for the next stage malware under |
Enterprise | T1059 | .005 | Command and Scripting Interpreter: Visual Basic |
Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.[1][2][4][10][11][12] |
.001 | Command and Scripting Interpreter: PowerShell |
Cobalt Group has used powershell.exe to download and execute scripts.[1][2][3][4][7][12] |
||
.003 | Command and Scripting Interpreter: Windows Command Shell |
Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands.[10] The group has used an exploit toolkit known as Threadkit that launches .bat files.[1][2][4][10][11][12] |
||
.007 | Command and Scripting Interpreter: JavaScript/JScript |
Cobalt Group has executed JavaScript scriptlets on the victim's machine.[1][2][4][10][11][12] |
||
Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
Cobalt Group has created new services to establish persistence.[4] |
Enterprise | T1573 | .002 | Encrypted Channel: Asymmetric Cryptography |
Cobalt Group has used the Plink utility to create SSH tunnels.[4] |
Enterprise | T1203 | Exploitation for Client Execution |
Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.[1][2][3][5][6][7][9][12] |
|
Enterprise | T1068 | Exploitation for Privilege Escalation |
Cobalt Group has used exploits to increase their levels of rights and privileges.[4] |
|
Enterprise | T1070 | .004 | Indicator Removal on Host: File Deletion |
Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.[1] |
Enterprise | T1105 | Ingress Tool Transfer |
Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers.[2][3] The group's JavaScript backdoor is also capable of downloading files.[10] |
|
Enterprise | T1559 | .002 | Inter-Process Communication: Dynamic Data Exchange |
Cobalt Group has sent malicious Word OLE compound documents to victims.[1] |
Enterprise | T1046 | Network Service Scanning |
Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.[2][3][4] |
|
Enterprise | T1027 | Obfuscated Files or Information |
Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.[1][10] |
|
Enterprise | T1566 | .002 | Phishing: Spearphishing Link |
Cobalt Group has sent emails with URLs pointing to malicious documents.[1] |
.001 | Phishing: Spearphishing Attachment |
Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.[1][2][3][4][5][6][11][12] |
||
Enterprise | T1055 | Process Injection |
Cobalt Group has injected code into trusted processes.[4] |
|
Enterprise | T1572 | Protocol Tunneling |
Cobalt Group has used the Plink utility to create SSH tunnels.[1][3][4] |
|
Enterprise | T1219 | Remote Access Software |
Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.[2][3][4] |
|
Enterprise | T1021 | .001 | Remote Services: Remote Desktop Protocol |
Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.[4] |
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
Cobalt Group has created Windows tasks to establish persistence.[4] |
Enterprise | T1218 | .003 | Signed Binary Proxy Execution: CMSTP |
Cobalt Group has used the command |
.010 | Signed Binary Proxy Execution: Regsvr32 |
Cobalt Group has used regsvr32.exe to execute scripts.[1][10][12] |
||
.008 | Signed Binary Proxy Execution: Odbcconf |
Cobalt Group has used |
||
Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.[10] |
Enterprise | T1204 | .002 | User Execution: Malicious File |
Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.[1][11] |
.001 | User Execution: Malicious Link |
Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.[1][11] |
||
Enterprise | T1220 | XSL Script Processing |
Cobalt Group used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.[1] |
Software
References
- Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.
- Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.
- Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.
- Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.
- Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.
- Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018.
- Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.
- Europol. (2018, March 26). Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested in Spain. Retrieved October 10, 2018.
- CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.
- Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.
- Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.
- Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.