Cobalt Group is a cybercriminal group notorious for synchronized ATM heists.
Cobalt, also known as Cobalt Group, is a cybercriminal group notorious for synchronized ATM heists. It primarily targets financial institutions in Europe, CIS countries (including Russia), and Malaysia. Key TTPs include Spearphishing Attachment for initial access, leveraging Cobalt Strike, Mimikatz, and PsExec for lateral movement. Defenders should focus on supply chain compromise vectors, monitor ATM networks, and enhance email filtering against malware like More_eggs and SpicyOmelette.
A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.
Monitor for suspicious download patterns to detect development of security tools or malware and block suspicious activities.
Harden supply chain security and monitor and intervene against suspicious email attachments or supply chain security breaches.
Monitor for and prevent suspicious Scheduled Tasks and Dynamic Data Exchange (DDE) usage.
Monitor for and prevent Windows Service creation or Registry Run Keys/Startup Folder modifications.
Monitor for and intervene against Exploitation attempts or Bypass User Account Control (UAC) activities.
Monitor for and intervene against suspicious Command Obfuscation or unusual Odbcconf usage.
Monitor for and intervene against Network Service Discovery and Security Software Discovery activities.
Monitor for and prevent suspicious Remote Desktop Protocol (RDP) activities.
Monitor for and intervene against suspicious DNS queries or Ingress Tool Transfer activities.
The Cobalt group is notorious for synchronized ATM heists.
It primarily targets financial institutions in Europe, CIS countries (including Russia), and Malaysia.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.