Cobalt Group Targets Banks in Eastern Europe with Double-Threat Tactic

Minimalist · Aug 30, 2018

The infamous financial cybercrime gang known as Cobalt Group has been spotted actively pushing a fresh campaign that uses a peculiar tactic: Double infection points and two command-and-control (C2) servers.

The Cobalt Group, a known financial cybercrime ring since 2016, has been suspected in attacks in dozens of countries around the world. It typically targets ATMs for jackpotting, and researchers believe the gang is also responsible for a series of attacks on the SWIFT banking system.
Click to expand...

https://threatpost.com/cobalt-group-targets-banks-in-eastern-europe-with-double-threat-tactic/

Minimalist · Sep 27, 2018

Notorious Hackers Serve SpicyOmelette to Unsuspecting Victims

The financially-motivated "Cobalt" hackers have been establishing a foothold onto victim machines using a piece of malware called SpicyOmelette, Secureworks reveals.
Click to expand...

https://www.securityweek.com/notorious-hackers-serve-spicyomelette-unsuspecting-victims

Minimalist · Oct 25, 2018

Cobalt Group tries to slip malicious PDFs past bank employees, researchers say

The recent attack tracked by Unit 42 is simple – the PDF document doesn’t have code or an exploit. Instead, the attackers use social engineering to try to get the bank employees to download the macros. A link embedded in the PDF redirects the target to a malicious document.
Click to expand...

https://www.cyberscoop.com/cobalt-group-pdfs-banks-palo-alto-networks-unit-42/

guest · Dec 11, 2018

Cobalt Bank Robbers Use New ThreadKit Malicious Doc Builder
December 11, 2018
https://www.bleepingcomputer.com/ne...bers-use-new-threadkit-malicious-doc-builder/

Observed in a campaign on October 30, the new tactics show an evolution of the ThreadKit macro delivery tool. The final payload downloaded this way is the CobInt, a signature malware for the Cobalt group.

An analysis from Fidelis cybersecurity company shows that new ThreadKit places into its own object the 'M' in the 'MZ' DOS format for executable files, and renames several of the objects inside.
"The rebuilt executable from the ThreadKit delivery is the downloader for CobInt," Fidelis said in a report shared with BleepingComputer, adding that the group chose to hide the main code in a resource section.

CobInt, also known as COOLPANTS, is a backdoor used by Cobalt for reconnaissance purposes that was discovered on a command and control (C2) server operated by the hackers.
Click to expand...

Minimalist · Aug 14, 2019

Financial hacking teams FIN7, Cobalt Group update tactics to haunt banks and retail

It’s starting to look like the global private sector might have a real problem on its hands.

Despite international media attention and a series of high profile arrests, some of the world’s most prolific cybercriminals only seem to be accelerating their hacking sprees.
Click to expand...

https://www.cyberscoop.com/fin7-cobalt-group-russian-hacking/

Log in or Sign up

Cobalt Group Targets Banks in Eastern Europe with Double-Threat Tactic

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Log in or Sign up

Cobalt Group Targets Banks in Eastern Europe with Double-Threat Tactic

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Useful Searches