ExCobalt is an APT group targeting Russian entities, known for its GoRed backdoor.
Analyst brief
ExCobalt is an APT group active since at least 2016 and believed to be linked to the Cobalt Gang. It primarily targets Russian organizations in metallurgy, telecommunications, mining, government, and software development. The group exploits supply chain weaknesses and uses a custom Golang-based backdoor called GoRed, alongside tools like Spark RAT, Mimikatz, and Linux privilege escalation exploits. Defenders should focus on supply chain risks, monitor for contractor account abuse, and hunt for GoRed backdoor indicators in their networks.
ExCobalt
unknown
ExCobalt is an APT group that has been active since at least 2016 and is believed to be linked to the notorious Cobalt Gang. The group primarily targets Russian organizations across sectors—including metallurgy, telecommunications, mining, information technology, government, and software development by exploiting supply chain weaknesses and compromised contractors for initial access. ExCobalt’s toolkit features a custom Golang‑based backdoor, GoRed, which enables remote command execution, credential harvesting, and detailed system reconnaissance, while the group also employs established tools such as Spark RAT, Mimikatz, and multiple Linux privilege escalation exploits. Researchers note that ExCobalt continually evolves its tactics and even modifies standard utilities to bypass security controls and maintain persistent access, underscoring its commitment to sophisticated cyberespionage and data theft operations.
ExCobalt primarily targets metallurgy, telecommunications, mining, government, and software development sectors in Russia.
What is the main custom tool of ExCobalt?+
ExCobalt's main custom tool is the Golang-based GoRed backdoor, which features remote command execution, credential harvesting, and system reconnaissance capabilities.