Full Report
Cobalt Gang is alive and well, and continued to attack financial institutions around the globe in 2019.
Analysis Summary
# Threat Actor: Cobalt Gang
## Attribution & Identity
* **Actor Name:** Cobalt Gang
* **Aliases:** Cobalt Group
* **Known Associations:** Often associated with large-scale financial thefts; noted for their technical proficiency in bypassing security controls and utilizing legitimate penetration testing tools for malicious purposes.
## Activity Summary
Throughout 2019, Cobalt Gang remained active, specifically targeting financial institutions globally. A primary campaign involved the use of spearphishing emails containing links to weaponized image (.IMG) files. These files served as the initial stage for a multi-step infection chain designed to deliver the CobInt stager and ultimately deploy a Cobalt Strike beacon.
## Tactics, Techniques & Procedures
* **Execution via LNK:** Use of malicious LNK files within disk images to trigger script execution.
* **UAC Bypass:** Implementation of OS-specific UAC bypasses using `eventvwr.exe` (for OS version 6.3 or earlier) and `fodhelper.exe` (for OS version 9.1 or newer).
* **Steganography/Decoy usage:** Use of decoy images to hide or facilitate the extraction of the payload.
* **Persistence & Evasion:** Use of the "hidden" attribute on files and process suspension (sleep) to evade detection.
**MITRE ATT&CK Mapping:**
* **T1192 - Spearphishing Link:** Delivered links to weaponized IMG files.
* **T1204 - User Execution:** Relied on victims opening the LNK file.
* **T1086 - PowerShell:** Used for dropping and executing the CobInt stager.
* **T1117 - Regsvr32:** Used to execute malicious DLL files.
* **T1047 - WMI:** Used to collect reconnaissance information about the target system.
* **T1088 - Bypass User Account Control:** Used Event Viewer and Features On Demand Helper.
* **T1027 - Obfuscated Files or Information:** Used obfuscated PowerShell scripts.
## Targeting
* **Sectors:** Financial institutions / Banking.
* **Geography:** Global (Worldwide financial organizations).
* **Victims:** Not explicitly named in the text, but defined as global financial entities.
## Tools & Infrastructure
* **Malware:**
* **CobInt (stager):** A downloader used to pull the final stage.
* **Cobalt Strike:** Used for command and control (C2) and post-exploitation (Beacon).
* **Infrastructure:**
* `hXXp://safestaticfirefox[.]com/uacuxuiaeoerkaryixju` (C2/Payload Delivery)
* `C:\Users\Public` (Local staging directory)
* `1.ps1` (Malicious PowerShell script)
## Implications
The Cobalt Gang continues to be a high-tier threat to the global financial sector. Their shift toward using disk image files (.IMG) and sophisticated UAC bypasses indicates an evolution in evasion techniques to bypass traditional email gateways and endpoint security. Their continued use of Cobalt Strike allows them to maintain a flexible and robust foothold once an environment is breached.
## Mitigations
* **Email Filtering:** Block or scrutinize emails containing links to unusual file types like .IMG, .ISO, or .VHD.
* **Scripting Policy:** Restrict or monitor PowerShell execution, particularly when initiated by common office applications or from the `C:\Users\Public` directory.
* **UAC Hardening:** Monitor for unusual child processes of `eventvwr.exe` and `fodhelper.exe`, which are frequently leveraged for UAC bypass.
* **Endpoint Monitoring:** Implement detection for `regsvr32.exe` calling remote locations or executing DLLs from non-standard paths.