CVE Intelligence
Início / Grupos de ameaça / Cobalt Group

Cobalt Group G0080

🔔 Criar alerta

Também conhecido como: GOLD KINGSWOOD, Cobalt Gang, Cobalt Spider

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

5
CVEs associadas
40
Técnicas
6
Malwares e ferramentas

Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims. Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2018-8174 Alta · 7.5 KEV Ransomware Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability
“Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”
CVE-2017-8759 Alta · 7.8 KEV Microsoft .NET Framework Remote Code Execution Vulnerability
“Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”
CVE-2017-8570 Alta · 7.8 KEV Microsoft Office Remote Code Execution Vulnerability
“Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”
CVE-2017-11882 Alta · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”
CVE-2017-0199 Alta · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability
“Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”

Técnicas por tática

Desenvolvimento de recursos
T1588.002 Tool
Acesso inicial
T1195.002 Compromise Software Supply ChainT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execução
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.007 JavaScriptT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1559.002 Dynamic Data Exchange
Persistência
T1037.001 Logon Script (Windows)T1053.005 Scheduled TaskT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup Folder
Escalada de privilégios
T1037.001 Logon Script (Windows)T1053.005 Scheduled TaskT1055 Process InjectionT1068 Exploitation for Privilege EscalationT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account Control
Furtividade
T1027.010 Command ObfuscationT1055 Process InjectionT1070.004 File DeletionT1218.003 CMSTPT1218.008 OdbcconfT1218.010 Regsvr32T1220 XSL Script Processing
Descoberta
T1046 Network Service DiscoveryT1518.001 Security Software Discovery
Movimento lateral
T1021.001 Remote Desktop Protocol
Comando e controle
T1071.001 Web ProtocolsT1071.004 DNST1105 Ingress Tool TransferT1219 Remote Access ToolsT1572 Protocol TunnelingT1573.002 Asymmetric Cryptography

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.