Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Cobalt · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

Cobalt

  • Cobalt Group
  • Cobalt Gang
  • GOLD KINGSWOOD
  • COBALT SPIDER
  • G0080
  • Mule Libra
  • Cobalt Spider

MITRE G0080 ↗

Cobalt — ATT&CK roseCO

attack rose · 34 techniques across 9 tactics

What changed

ledger · newest first
  1. —todaynew CVE5 new CVEs: CVE-2017-0199, CVE-2017-11882, CVE-2017-8570, CVE-2017-8759, CVE-2018-8174

Analyst brief

misp-galaxy + mitre-attack

A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

34 techniques · 9 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    3 techniques

  3. Execution

    9 techniques

  4. Persistence

    3 techniques

  5. Privilege escalation

    2 techniques

  6. Stealth

    7 techniques

  7. Discovery

    2 techniques

  8. Lateral movement

    1 technique

  9. Command and control

    6 techniques

select a technique

Arsenal

3 malware · 3 tools
Malware
Malware · 3ATT&CK
More_eggsS0284 ↗
SpicyOmeletteS0646 ↗
Cobalt StrikeS0154 ↗
Tools
Tools · 3ATT&CK
MimikatzS0002 ↗
SDeleteS0195 ↗
PsExecS0029 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Cobalt is cited as exploiting

none on KEV
  1. CVE-2017-01992026-10-17
    1. “Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions”

      cited as exploiting · source: proofpoint.com ↗ · 2026-10-17

    2. “Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    3. “This adversary incorporated CVE-2017-0199, CVE- 2017-8759 and CVE-2017-11882 into their spear- phishing operations shortly after zero-day.”

      cited as exploiting · named nearby · source: go.crowdstrike.com ↗ · 2026-10-17

  2. CVE-2017-87592026-10-17
    1. “Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2017-85702026-10-17
    1. “Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  4. CVE-2018-81742026-10-17
    1. “Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  5. CVE-2017-118822026-10-17
    1. “Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “This adversary incorporated CVE-2017-0199, CVE- 2017-8759 and CVE-2017-11882 into their spear- phishing operations shortly after zero-day.”

      cited as exploiting · named nearby · source: go.crowdstrike.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2017Operation Cobalt Kitty: A large-scale APT in Asia carried out by the OceanLotus GroupCybereason ↗
  2. 2017Operation Cobalt Kitty Threat Actor Profile & IOCCybereason ↗

Take it with you

keyless · no signup

References

22 sources
  1. 1.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists
  2. 2.bleepingcomputer.com/news/security/cobalt-hacking-group-tests-banks-in-russ…
  3. 3.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the…
  4. 4.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-sept…
  5. 5.group-ib.com/blog/cobalt
  6. 6.reuters.com/article/us-taiwan-cyber-atms/taiwan-atm-heist-linked-t…
  7. 7.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integra…
  8. 8.blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-m…
  9. 9.riskiq.com/blog/labs/cobalt-strike
  10. 10.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks
  11. +12 more in the JSON record

Track Cobalt on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.