Cobalt Group
MITREUnknown
Unknown
Unknown
[Cobalt Group](https://attack.mitre.org/groups/G0080) is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. [Cobalt Group](https://attack.mitre.org/groups/G0080) has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: PTSecurity Cobalt Dec 2016)(Citation: Group IB Cobalt Aug 2017)(Citation: Proofpoint Cobalt June 2017)(Citation: RiskIQ Cobalt Nov 2017)(Citation: RiskIQ Cobalt Jan 2018) Reporting indicates there may be links between [Cobalt Group](https://attack.mitre.org/groups/G0080) and both the malware [Carbanak](https://attack.mitre.org/software/S0030) and the group [Carbanak](https://attack.mitre.org/groups/G0008).(Citation: Europol Cobalt Mar 2018)
Techniques Used (34)
| ID | ATT&CK | Tactics |
|---|---|---|
| T1021.001 | Remote Desktop Protocol | - |
| T1027.010 | Command Obfuscation | - |
| T1037.001 | Logon Script (Windows) | - |
| T1046 | Network Service Discovery | - |
| T1053.005 | Scheduled Task | - |
| T1055 | Process Injection | - |
| T1059.001 | PowerShell | - |
| T1059.003 | Windows Command Shell | - |
| T1059.005 | Visual Basic | - |
| T1059.007 | JavaScript | - |
| T1068 | Exploitation for Privilege Escalation | - |
| T1070.004 | File Deletion | - |
| T1071.001 | Web Protocols | - |
| T1071.004 | DNS | - |
| T1105 | Ingress Tool Transfer | - |
Aliases (315)
Related Malware (6)
Metadata
| ID: | 887 |
| Created: | 13/01/2026 17:48 |
| Updated: | 06/03/2026 16:00 |