Full Report
New attacks and joint operations
Analysis Summary
# Threat Actor: Cobalt (also known as Cobalt Group/Cobalt Gang)
## Attribution & Identity
* **Actor Identification:** Cobalt is a highly sophisticated cybercriminal group primarily focused on financial institutions.
* **Aliases:** Cobalt Gang, Cobalt Group.
* **Known Associations:** The article suggests potential "joint operations" and the likelihood of members joining other existing cybercriminal groups or reforming into a "Cobalt 2.0" following law enforcement pressure.
## Activity Summary
Despite the March 2018 arrest of the group's alleged leader in Spain, Cobalt remained active and technologically resilient. Their 2018 campaigns showed a strategic shift from Russia/CIS toward international targets, including the US, Europe, and Southeast Asia. Key operations included:
* **March 2018:** Impersonation of IBM, Verifon (POS terminal vendor), and Spamhaus.
* **April 2018:** Utilization of a compromised Swedish company's mail server.
* **May 2018:** High-profile impersonation of SWIFT, a major anti-virus vendor, and the European Central Bank.
## Tactics, Techniques & Procedures
* **Phishing & Brand Impersonation:** Extensive use of look-alike (typosquatted) domains to mimic trusted organizations (e.g., `spamhuas[.]com`).
* **Infrastructure Hijacking:** Obtaining control of legitimate mail servers or accounts to launch downstream attacks on banks.
* **Social Engineering:** Crafting emails purporting to be security alerts, service notices, or official communications from financial regulators and security vendors.
* **Persistence:** Use of JavaScript (JS) backdoors to maintain access to victim environments.
**MITRE ATT&CK IDs (Inferred from context):**
* **T1566.001:** Phishing: Spearphishing Attachment
* **T1566.002:** Phishing: Spearphishing Link
* **T1583.001:** Acquire Infrastructure: Domains
* **T1071.001:** Application Layer Protocol: Web Protocols (JS Backdoor C2)
* **T1078:** Valid Accounts (Compromised mail servers)
## Targeting
* **Sectors:** Financial Services (Banks), POS Terminal Vendors, Cybersecurity Organizations.
* **Geography:** Russia, CIS, United States, Europe, Sweden.
* **Victims:** Leading banks in Russia/CIS, European Central Bank (impersonated/targeted), SWIFT (impersonated), and over 100 banks worldwide historically.
## Tools & Infrastructure
* **Malware:**
* JS Backdoor (specifically mentioned in SWIFT and ECB campaigns).
* **Infrastructure:**
* `ibm-cert[.]com`
* `ibm-warning[.]com`
* `ibm-notice[.]com`
* `dns-verifon[.]com`
* `spamhuas[.]com` (typosquat of `spamhaus[.]org`)
## Implications
The group has demonstrated extreme resilience; the arrest of a leader did not halt operations, suggesting a decentralized structure or a highly capable remaining core. The evolution of their TTPs and their willingness to impersonate global financial authorities (SWIFT, ECB) indicates a high level of confidence and a continuing threat to the global financial system. The assessment suggests a "redistribution" of talent into a "Cobalt 2.0."
## Mitigations
* **Email Security:** Implement strict DMARC, SPF, and DKIM checks to identify spoofed domains.
* **Domain Monitoring:** Proactively monitor for typosquatted domains involving the organization’s brand or critical service providers (like SWIFT or security vendors).
* **Endpoint Protection:** Deploy solutions capable of detecting and blocking malicious JavaScript execution and unauthorized backdoor activity.
* **Security Awareness:** Train employees to scrutinize the sender's domain closely, even if the email appears to be from a trusted partner or regulatory body.