aol.pm

Cobalt Group

IntrusionSet · ATTACK:enterprise:G0080

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0080",
  "title": "Cobalt Group",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0080",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--dc6fe6ee-04c2-49be-ba3d-f38d2463c02a",
  "external_id": "G0080",
  "domain": "enterprise",
  "created": "2018-10-17T00:14:20.652Z",
  "modified": "2026-07-31T18:48:22.149Z",
  "version": "2.1",
  "aliases": [
    "Cobalt Group",
    "GOLD KINGSWOOD",
    "Cobalt Gang",
    "Cobalt Spider"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Cobalt Spider"
    },
    {
      "source_name": "GOLD KINGSWOOD"
    },
    {
      "source_name": "Cobalt Gang"
    },
    {
      "source_name": "Cobalt Group"
    },
    {
      "source_name": "Crowdstrike Global Threat Report Feb 2018",
      "url": "https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report"
    },
    {
      "source_name": "Secureworks GOLD KINGSWOOD September 2018",
      "url": "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"
    },
    {
      "source_name": "Europol Cobalt Mar 2018",
      "url": "https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain"
    },
    {
      "source_name": "Morphisec Cobalt Gang Oct 2018",
      "url": "https://blog.morphisec.com/cobalt-gang-2.0"
    },
    {
      "source_name": "RiskIQ Cobalt Nov 2017",
      "url": "https://web.archive.org/web/20190508170630/https://www.riskiq.com/blog/labs/cobalt-strike/"
    },
    {
      "source_name": "RiskIQ Cobalt Jan 2018",
      "url": "https://web.archive.org/web/20190508170147/https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/"
    },
    {
      "source_name": "Group IB Cobalt Aug 2017",
      "url": "https://www.group-ib.com/blog/cobalt"
    },
    {
      "source_name": "Proofpoint Cobalt June 2017",
      "url": "https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target"
    },
    {
      "source_name": "PTSecurity Cobalt Dec 2016",
      "url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"
    },
    {
      "source_name": "PTSecurity Cobalt Group Aug 2017",
      "url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"
    },
    {
      "source_name": "Talos Cobalt Group July 2018",
      "url": "https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"
    }
  ]
}

Explicit source assertions (40)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--029bdc73-5054-45eb-b9d0-e4281f69d85a

TrendMicro Cobalt Group Nov 2017 · RiskIQ Cobalt Nov 2017 · Group IB Cobalt Aug 2017 · Proofpoint Cobalt June 2017 · PTSecurity Cobalt Dec 2016 · PTSecurity Cobalt Group Aug 2017 · Talos Cobalt Group July 2018 · Unit 42 Cobalt Gang Oct 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07ab4fde-e1fd-4740-863e-c40cc8722d32

PTSecurity Cobalt Group Aug 2017 · PTSecurity Cobalt Dec 2016 · Morphisec Cobalt Gang Oct 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1010f466-818d-4387-9e43-9ae5e9bf9a40

Morphisec Cobalt Gang Oct 2018 · Talos Cobalt Group July 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b1027ff-81d2-4ae9-85ac-0d886dea8a04

Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1218.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d10495f-64e6-43d9-85cd-4d74a8acdf7c

TrendMicro Cobalt Group Nov 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1195.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23fe4e74-9a8e-40e6-99c0-25eb00775a89

Crowdstrike GTR2020 Mar 2020

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30ff291e-e546-4084-8b5b-22fd5a597449

Morphisec Cobalt Gang Oct 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4807dbdc-6bcb-4aed-96f4-a782551eaefe

PTSecurity Cobalt Group Aug 2017 · PTSecurity Cobalt Dec 2016 · Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1559.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bfaaf99-6884-4df1-af72-0cc61ce50aa0

Talos Cobalt Group July 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b078c2e-229d-4ef0-8e46-2164354caee9

Talos Cobalt Group July 2018 · Unit 42 Cobalt Gang Oct 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bd3526a-1ae2-4b09-8be7-0eef6ae33155

Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1218.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5dbd040e-0433-42ca-8e03-b3741be31cb2

Talos Cobalt Group July 2018 · Morphisec Cobalt Gang Oct 2018 · Unit 42 Cobalt Gang Oct 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1218.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62c5050d-983c-44f7-ba23-f2820398eb67

Talos Cobalt Group July 2018 · Morphisec Cobalt Gang Oct 2018 · TrendMicro Cobalt Group Nov 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b083f3f-f8db-403d-b922-308b79d20cc7

Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70d1a246-4ff2-452d-babf-ed47bccbf1c4

TrendMicro Cobalt Group Nov 2017 · RiskIQ Cobalt Jan 2018 · Group IB Cobalt Aug 2017 · PTSecurity Cobalt Dec 2016 · PTSecurity Cobalt Group Aug 2017 · Talos Cobalt Group July 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7363ed1a-6f75-4ded-9179-2fdba17f6cf1

PTSecurity Cobalt Dec 2016

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78865095-f63e-461c-9e32-e202d514747d

Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d115073-c008-4394-867d-07c385d3db87

Talos Cobalt Group July 2018 · PTSecurity Cobalt Group Aug 2017 · Group IB Cobalt Aug 2017 · Morphisec Cobalt Gang Oct 2018 · Unit 42 Cobalt Gang Oct 2018 · TrendMicro Cobalt Group Nov 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ec2b835-9c82-4a0a-9730-5f4b87e233f4

Crowdstrike Global Threat Report Feb 2018 · TrendMicro Cobalt Group Nov 2017 · RiskIQ Cobalt Nov 2017 · RiskIQ Cobalt Jan 2018 · Proofpoint Cobalt June 2017 · PTSecurity Cobalt Dec 2016 · PTSecurity Cobalt Group Aug 2017 · Talos Cobalt Group July 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88852c38-9aeb-47f4-be63-dc09b8583155

Talos Cobalt Group July 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b4fd69e-a3c6-4721-9aed-d8235a93672e

Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1220

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c13ef6b-5274-4de0-9fad-531b9c87309e

Talos Cobalt Group July 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8de247e5-8d6b-4a07-bd65-ba3c3ca57923

Talos Cobalt Group July 2018 · PTSecurity Cobalt Dec 2016 · Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e8bebc7-14ff-4c84-a2a4-472446c5897a

Talos Cobalt Group July 2018 · PTSecurity Cobalt Group Aug 2017 · Group IB Cobalt Aug 2017 · Morphisec Cobalt Gang Oct 2018 · Unit 42 Cobalt Gang Oct 2018 · TrendMicro Cobalt Group Nov 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95618672-6f7f-4055-9c96-29f75e276d5b

Talos Cobalt Group July 2018 · Secureworks GOLD KINGSWOOD September 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c8cf20d-b834-4460-a8a8-13d96c19d2ea

Talos Cobalt Group July 2018 · Unit 42 Cobalt Gang Oct 2018 · Secureworks GOLD KINGSWOOD September 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0493e99-06ba-4f40-9aae-6f7f9bad6caa

Morphisec Cobalt Gang Oct 2018 · Talos Cobalt Group July 2018 · PTSecurity Cobalt Group Aug 2017 · Group IB Cobalt Aug 2017 · Morphisec Cobalt Gang Oct 2018 · Unit 42 Cobalt Gang Oct 2018 · TrendMicro Cobalt Group Nov 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:S0284

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a80751f1-8def-4415-a38b-35ceb703244c

Talos Cobalt Group July 2018 · Crowdstrike GTR2020 Mar 2020

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:S0646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9062522-1891-4405-b8e6-f6465834c18a

Secureworks GOLD KINGSWOOD September 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:S0195

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae11039c-6711-4860-a1b6-c7a8e0bcbbfb

PTSecurity Cobalt Dec 2016

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b398ed8d-5801-4cf0-bea2-c8b62c568bcd

Talos Cobalt Group July 2018 · PTSecurity Cobalt Dec 2016 · Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bab233b8-640c-4a8b-90fa-d5b959adefbb

Crowdstrike Global Threat Report Feb 2018 · TrendMicro Cobalt Group Nov 2017 · RiskIQ Cobalt Nov 2017 · RiskIQ Cobalt Jan 2018 · Group IB Cobalt Aug 2017 · Proofpoint Cobalt June 2017 · PTSecurity Cobalt Group Aug 2017 · Talos Cobalt Group July 2018

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd5bc949-6b6b-4511-87f7-3a439a4681da

Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1572

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c50f75fe-e7a9-4190-9ca8-a28187955669

Talos Cobalt Group July 2018 · PTSecurity Cobalt Dec 2016 · Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfb7e335-e7a3-4dc3-91b8-70381a888222

Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d54a98b2-8023-43ac-8577-53796b1efa55

Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e46dc495-5581-471c-84b5-b0dd825471f9

PTSecurity Cobalt Group Aug 2017 · Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1219

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e74cdd3d-4ac7-42c5-a7ac-e2f58371fc5b

PTSecurity Cobalt Group Aug 2017 · PTSecurity Cobalt Dec 2016 · Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--edcd7a59-f8e0-41e5-b0f5-8d348fa13a10

PTSecurity Cobalt Group Aug 2017 · PTSecurity Cobalt Dec 2016 · Group IB Cobalt Aug 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1037.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9283994-d216-4796-989d-a375eb4834a9

Morphisec Cobalt Gang Oct 2018

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.