Cobalt Group

Techniques (MITRE ATT&CK)34

SourceMITRE ATT&CK

Also known as:COBALT SPIDERCobalt GangCobalt SpiderG0080GOLD KINGSWOODMule Libra

Vexday analysis

Cobalt Group (também identificado como GOLD KINGSWOOD, Cobalt Gang e Cobalt Spider) é um grupo de ameaça com motivação financeira ativo pelo menos desde 2016, com atuação direcionada a instituições financeiras. Suas intrusões visam sistemas de ATM, processamento de cartões, plataformas de pagamento e redes SWIFT, com foco principal em bancos da Europa Oriental, Ásia Central e Sudeste Asiático. Um dos supostos líderes do grupo foi preso na Espanha no início de 2018, embora o grupo permaneça ativo e utilize organizações comprometidas como vetor para atingir vítimas adicionais. O MITRE ATT&CK documenta 34 técnicas associadas ao grupo (identificador G0080), que também tem 5 CVEs atribuídas à sua atividade de exploração.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity66

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 34

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Tool

Initial access

Compromise Software Supply Chain Spearphishing Attachment Spearphishing Link

Execution

Scheduled Task PowerShell Windows Command Shell Visual Basic JavaScript Exploitation for Client Execution Malicious Link Malicious File Dynamic Data Exchange

Persistence

Logon Script (Windows)Windows Service Registry Run Keys / Startup Folder

Privilege escalation

Exploitation for Privilege Escalation Bypass User Account Control

Discovery

Network Service Discovery Security Software Discovery

Lateral movement

Remote Desktop Protocol

Command and control

Web Protocols DNS Ingress Tool Transfer Remote Access Tools Protocol Tunneling Asymmetric Cryptography

stealth

Command Obfuscation Process Injection File Deletion CMSTP Odbcconf Regsvr32 XSL Script Processing

Exploited vulnerabilities 5

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2017-11882HIGHEPSS 100%KEV CVE-2017-0199HIGHEPSS 100%KEV CVE-2018-8174HIGHEPSS 89%KEV CVE-2017-8759HIGHEPSS 87%KEV CVE-2017-8570HIGHEPSS 86%KEV

Known infrastructure 1527

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port45.221.118.46:80Cobalt Strikethreatfox

ip:port45.221.118.46:443Cobalt Strikethreatfox

ip:port38.76.183.197:8082Cobalt Strikethreatfox

ip:port8.222.188.173:443Cobalt Strikethreatfox

ip:port8.219.220.240:7777Cobalt Strikethreatfox

ip:port209.99.184.234:50050Cobalt Strikethreatfox

ip:port120.77.42.217:50000Cobalt Strikethreatfox

ip:port49.235.52.47:3000Cobalt Strikethreatfox

ip:port49.235.52.47:8080Cobalt Strikethreatfox

ip:port49.235.52.47:80Cobalt Strikethreatfox

ip:port49.235.52.47:443Cobalt Strikethreatfox

ip:port49.235.52.47:8083Cobalt Strikethreatfox

ip:port147.139.136.105:8080Cobalt Strikethreatfox

ip:port38.207.177.165:8080Cobalt Strikethreatfox

ip:port147.139.136.105:80Cobalt Strikethreatfox

ip:port147.139.136.105:22Cobalt Strikethreatfox

ip:port147.139.136.105:443Cobalt Strikethreatfox

ip:port2.57.241.129:80Cobalt Strikethreatfox

ip:port38.207.177.165:80Cobalt Strikethreatfox

ip:port38.207.177.165:443Cobalt Strikethreatfox

ip:port147.139.245.149:801Cobalt Strikethreatfox

ip:port45.221.118.46:8080Cobalt Strikethreatfox

ip:port119.45.198.250:55555Cobalt Strikethreatfox

ip:port118.24.42.214:443Cobalt Strikethreatfox

ip:port47.251.29.219:50050Cobalt Strikethreatfox

ip:port47.254.68.68:50050Cobalt Strikethreatfox

ip:port172.232.97.189:4444Cobalt Strikethreatfox

ip:port149.88.66.234:21Cobalt Strikethreatfox

ip:port47.108.86.120:22Cobalt Strikethreatfox

ip:port47.108.86.120:111Cobalt Strikethreatfox

+1527 indicators in total. See them all on the IOCs page.

References

Cobalt Group uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →