Actor: Cobalt Strike — Threat Intelligence

From RTF to Cobalt Strike passing via Flash

2017-02-06 ⚑ Cobalt Gang

12

IOCs

Similarities Between Carbanak and FIN7 Malware Suggest Actors Are Closely Related

2017-04-28 ⚑ Anunak

20

IOCs

MWI Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions

2017-06-04

—

IOCs

Privileges and Credentials: Phished at the Request of Counsel

2017-06-06 ⚑ Shell Crew

28

IOCs

"Исковое заявление" and "Выписка" - Cobalt Group (aka Cobalt Gang) Activity observed on September 20, 2017

2017-09-21

—

IOCs

An Update on Winnti

2017-10-17 ⚑ Winnti

20

IOCs

Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks

2017-11-20

—

IOCs

Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks

2017-11-25

—

IOCs

Cobalt Group Gaffe Reveals All Targets in Attack on Financial Institutions

2017-11-29

3

IOCs

Cobalt Malware Strikes Using CVE-2017-11882 RTF Vulnerability | Fortinet Blog

2017-11-29

—

IOCs

Another CobaltStrike

2017-12-18

—

IOCs

Looks like CobaltStrike

2017-12-29

—

IOCs

Trojan:Win32/Conbea

2018-03-06

—

IOCs

Unknown actor leverages miners, Iron ransomware and Cobalt Strike

2018-05-05

—

IOCs

APT10 Using Cobalt Strike and Continuing to Target UK

2018-05-21 ⚑ APT10

8

IOCs

New Cobalt Group campaign targeting eastern Europe and Russian institutions

2018-08-30 ⚑ Cobalt group

38

IOCs

Cobalt Strike targeting Ukranian Telecoms

2018-10-23

232

IOCs

Hiding a beacon in a jquery

2018-11-26

5

IOCs

Cobalt.Strike.APT - Malware Domain Feed

2019-02-13

—

IOCs

NEW GLOBAL ATTACK ON POINT OF SALE SYSTEMS

2019-03-04

—

IOCs