Cobalt Group

Técnicas (MITRE ATT&CK)34

FuenteMITRE ATT&CK

También conocido como:COBALT SPIDERCobalt GangCobalt SpiderG0080GOLD KINGSWOODMule Libra

Sobre el grupo

Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims. Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak.

Cadena de ataque

Escenario plausible montado a partir de las técnicas reales del grupo, ordenadas por las fases de un ataque. Cada etapa muestra cómo suele actuar el grupo.

Severidad del arsenal66

Impacto: Alto

Cadena ilustrativa derivada de las técnicas documentadas en MITRE ATT&CK — no representa un ataque específico ya ocurrido. La severidad resume el arsenal conocido (cobertura de la cadena, CVEs en explotación activa, técnicas).

Técnicas (MITRE ATT&CK) 34

Cómo opera el grupo, mapeado por la matriz MITRE ATT&CK y organizado por las fases de un ataque.

Preparación de recursos

Tool

Acceso inicial

Compromise Software Supply Chain Spearphishing Attachment Spearphishing Link

Ejecución

Scheduled Task PowerShell Windows Command Shell Visual Basic JavaScript Exploitation for Client Execution Malicious Link Malicious File Dynamic Data Exchange

Persistencia

Logon Script (Windows)Windows Service Registry Run Keys / Startup Folder

Escalada de privilegios

Exploitation for Privilege Escalation Bypass User Account Control

Descubrimiento

Network Service Discovery Security Software Discovery

Movimiento lateral

Remote Desktop Protocol

Comando y control

Web Protocols DNS Ingress Tool Transfer Remote Access Tools Protocol Tunneling Asymmetric Cryptography

stealth

Command Obfuscation Process Injection File Deletion CMSTP Odbcconf Regsvr32 XSL Script Processing

Vulnerabilidades explotadas 5

CVEs que este grupo es conocido por explotar, según MITRE ATT&CK. Ordenadas por gravedad real.

CVE-2017-11882HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2017-0199HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2017-8570HIGHEPSS 90%KEV MITRE ATT&CK

CVE-2017-8759HIGHEPSS 89%KEV MITRE ATT&CK

CVE-2018-8174HIGHEPSS 88%KEV MITRE ATT&CK

Infraestructura conocida 2996

Indicadores reales (C2, dominios, URLs y hashes) asociados al malware que usa este grupo. Fuente: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port193.160.32.138:18082Cobalt Strikethreatfox

ip:port132.243.172.224:80Cobalt Strikethreatfox

ip:port31.207.4.106:443Cobalt Strikethreatfox

ip:port114.215.184.158:8000Cobalt Strikethreatfox

urlhttp://69.49.229.88:443/MQEwCobalt Strikethreatfox

ip:port154.12.17.20:8080Cobalt Strikethreatfox

ip:port154.12.17.20:443Cobalt Strikethreatfox

ip:port154.12.17.20:22Cobalt Strikethreatfox

ip:port154.12.17.20:80Cobalt Strikethreatfox

ip:port129.204.55.230:443Cobalt Strikethreatfox

ip:port47.94.56.71:8080Cobalt Strikethreatfox

ip:port47.94.56.71:80Cobalt Strikethreatfox

ip:port47.94.56.71:443Cobalt Strikethreatfox

ip:port45.227.253.132:8080Cobalt Strikethreatfox

ip:port45.227.253.132:443Cobalt Strikethreatfox

ip:port45.227.253.132:80Cobalt Strikethreatfox

ip:port45.227.253.132:32775Cobalt Strikethreatfox

ip:port117.158.148.164:65535Cobalt Strikethreatfox

ip:port38.76.190.209:8888Cobalt Strikethreatfox

ip:port188.227.14.105:8080Cobalt Strikethreatfox

ip:port186.241.115.168:12443Cobalt Strikethreatfox

ip:port109.206.247.245:10881Cobalt Strikethreatfox

ip:port43.134.112.45:7500Cobalt Strikethreatfox

ip:port43.134.112.45:7000Cobalt Strikethreatfox

ip:port43.134.112.45:80Cobalt Strikethreatfox

ip:port43.134.112.45:8080Cobalt Strikethreatfox

ip:port43.134.112.45:443Cobalt Strikethreatfox

ip:port43.134.112.45:22Cobalt Strikethreatfox

ip:port101.34.208.175:18317Cobalt Strikethreatfox

md5_hashe4a34372eab0832d0682fa986a8e0b97Cobalt Strikethreatfox

+2996 indicadores en total. Míralos todos en la página de IOCs.

Referencias

El grupo Cobalt Group usa técnicas y explota fallas reales. El Pentest Autónomo con IA de TrueHacking simula esos ataques en tu infraestructura y aporta más seguridad a tu aplicación.

Conocer el Pentest Autónomo con IA →