Adversary: Cobalt Spider - Threat Actor | Crowdstrike Adversary Universe

Adversary

Cobalt Spider

Origins

Unknown

Community identifiers

Cobalt Group, Cobalt Gang

Cobalt Spider is a financially-motivated criminal group responsible for campaigns against financial institutions across a variety of regions, including Russia, Central Asia, Europe, the Middle East, and the Americas.

In 2016, a key individual and several other technical personnel split from CARBON to continue targeting Russia-based financial institutions. CrowdStrike Intelligence has tracked this separate adversary as Cobalt Spider. Cobalt Spider initially used Cobalt Strike in phishing campaigns against financial institutions in the Commonwealth of Independent States (CIS).

The adversary conducts spear phishing campaigns that frequently impersonate financial institutions to deliver a variety of different dropper documents, which in turn install the custom COBINT backdoor.

Cobalt Spider has likely monetized access to financial institutions by conducting ATM cash-outs.

While Cobalt Spider initially targeted Russia and the CIS, almost all 2019 campaigns focused on financial institutions outside of this region. Specifically, most 2019 campaigns targeted companies in Europe, the Middle East, and Central and South America.

Technical Tradecraft

  • Sends spear phishing messages frequently impersonating financial institutions, to include commercial banks as well as SWIFT and the European Central Bank (ECB).
  • Has used Google Drive to host exploit documents
  • Droppers have included exploit documents, macro documents, JavaScripts, and archives containing COBINT.
  • Created web sites impersonating SWIFT and the ECB, which hosted trojanized updates for the

Target Nations

  • Flag Icon of the country Costa Rica

    Costa Rica

  • Flag Icon of the country Europe

    Europe

  • Flag Icon of the country Georgia

    Georgia

  • Flag Icon of the country Germany

    Germany

  • Flag Icon of the country Greece

    Greece

  • Flag Icon of the country Kazakhstan

    Kazakhstan

  • Flag Icon of the country Kuwait

    Kuwait

  • Flag Icon of the country Latvia

    Latvia

  • Flag Icon of the country Malaysia

    Malaysia

  • Flag Icon of the country Panama

    Panama

  • Flag Icon of the country Qatar

    Qatar

  • Flag Icon of the country Russian Federation

    Russian Federation

  • Flag Icon of the country Taiwan

    Taiwan

  • Flag Icon of the country Turkey

    Turkey

  • Flag Icon of the country United States

    United States