Cobalt

No sourced public emblem in this profile.

reference profile · reported nexus: Unknown (not nationality)

A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.

Source-reported aliases: Cobalt Group, Cobalt Gang, GOLD KINGSWOOD, COBALT SPIDER, G0080, Mule Libra. Associations do not prove equivalence.

Target geography

Catalog-listed countries (associations, not attack counts): No country-level metadata

No bound claim-post feed for this label.

Historical casebook

No dated record curated yet; absence does not establish inactivity.

Planned Kinwilder coverage

Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.

No assigned review window.

References

Pinned source catalog

https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/

https://www.bleepingcomputer.com/news/security/cobalt-hacking-group-tests-banks-in-russia-and-romania/

https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish

https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-september-cobalt-spider/

https://www.group-ib.com/blog/cobalt

https://www.reuters.com/article/us-taiwan-cyber-atms/taiwan-atm-heist-linked-to-european-hacking-spree-security-firm-idUSKBN14P0CX

https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target

https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/

https://www.riskiq.com/blog/labs/cobalt-strike/

https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/

https://unit42.paloaltonetworks.com/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/

https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain

https://www.computerweekly.com/news/252446153/Three-Carbanak-cyber-heist-gang-members-arrested

https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf

https://attack.mitre.org/groups/G0080/

https://unit42.paloaltonetworks.com/atoms/mulelibra/

Submission and profile-update guide · Publisher API

Editorial standard · root@kinwilder.com · RSS · Outpost