Full Report
Cobalt Group Bypasses Antivirus Protection
Analysis Summary
# Threat Actor: Cobalt Group
## Attribution & Identity
* **Actor Name:** Cobalt Group (also known as Cobalt Gang).
* **Aliases/Associations:** Often associated with or compared to other financial crime syndicates like FIN7 or Carbanak due to shared methodologies and targeting.
* **Identity:** A highly sophisticated cybercriminal group primarily focused on financial institutions.
## Activity Summary
The group has been identified conducting campaigns utilizing malicious documents designed to bypass traditional antivirus protections. These campaigns leverage social engineering—specifically themes related to banking and financial systems like SWIFT—to deliver malware. Recent operations involve the exploitation of legacy Microsoft Office vulnerabilities to gain an initial foothold and deploy multi-stage payloads.
## Tactics, Techniques & Procedures
* **Phishing/Social Engineering:** Sending highly targeted emails with themes like "Changes to Payment Transfer Rules" and "Swift changes."
* **Vulnerability Exploitation:** Exploiting **CVE-2017-11882** (T1203) within the Microsoft Equation Editor component to execute arbitrary code via malicious `.rtf` and `.doc` files.
* **Defense Evasion:** Bypassing AV protections using obfuscated scripts and staged payloads to minimize the footprint of the initial infection.
* **Staging & Execution:** Use of `.txt` and `.exe` files for secondary staging of payloads.
* **MITRE ATT&CK IDs:**
* **T1566.001:** Phishing: Spearphishing Attachment
* **T1203:** Exploitation for Client Execution (Microsoft Equation Editor)
* **T1059:** Command and Scripting Interpreter
* **T1071.001:** Application Layer Protocol: Web Protocols (C2)
## Targeting
* **Sectors:** Financial Services, Banking, and Payment Processing.
* **Geography:** Global, with a historical emphasis on Eastern Europe, Russia, and Southeast Asia.
* **Victims:** Specifically targeting employees handling SWIFT transfers, Visa PayWave systems, and general banking inter-bank communications.
## Tools & Infrastructure
* **Malware Families:**
* **Cobalt Strike:** Use of "beacon_x32" and "beacon_x64" (T1071).
* **Custom Droppers:** Initial stage loaders (e.g., `w.exe`, `x.txt`).
* **Infrastructure:**
* **C2 Domains:**
* `cards-cbr[.]ru`
* `updatesupermaster[.]info`
* `visa-pay[.]com`
* `swift-alliance[.]com`
* **IP Addresses:**
* `138.68.234[.]128`
* `104.254.99[.]77`
* `104.200.67[.]112`
* `139.59.89[.]20`
* `67.205.190[.]195`
* `93.113.131[.]162`
* **Sender Addresses:** `a.shevcov@cards-cbr[.]ru`, `admin@visa-pay[.]com`, `support@swift-alliance[.]com`.
## Implications
The Cobalt Group remains a top-tier threat to the global financial sector. Their ability to weaponize known but effective vulnerabilities (like CVE-2017-11882) suggests they rely on the delayed patching cycles of large organizations. By mimicking legitimate financial bodies (CBR, SWIFT, Visa), they achieve high success rates in social engineering, leading to potential large-scale unauthorized fund transfers and network-wide compromises.
## Mitigations
* **Patch Management:** Immediately install the official Microsoft patch for **CVE-2017-11882**.
* **Registry Hardening:** Disable the Equation Editor component by setting the "Compatibility Flags" to `0x400` in the registry for both 32-bit and 64-bit Office installations.
* **Email Security:** Implement advanced threat protection to scan for and block `.rtf` and `.doc` attachments containing exploit code.
* **Network Monitoring:** Monitor and block traffic to the identified C2 infrastructure and monitor for unauthorized Cobalt Strike beacon activity.