Cobalt Group

Profile narrative

The group known as Cobalt Group, also tracked as TEMP.Metastrike, is a financially motivated cybercriminal entity. Its primary activity involves conducting spear phishing campaigns that masquerade as legitimate financial partners or vendors. These campaigns are directed at financial institutions located mainly in Eastern Europe and Russia. The objective of the attacks is to deliver malware that enables subsequent fraud and network intrusion.

While the prompt does not disclose the group's size or organizational structure, it notes that the campaigns have affected multiple organizations and resulted in significant financial losses. The attacks have been observed to deploy weaponized documents and binaries that install reconnaissance backdoors. This indicates a capability to sustain operations across several targets over time.

Distinguishing attributes of the group include the use of specific malware families such as CobInt/COOLPANTS and the JavaScript payload more_eggs. These tools establish persistence via modified Windows registry keys and employ RC4 encryption for communications. The group’s infrastructure has been linked to command‑and‑control domains like rietumu[.]me, allowing remote control of compromised systems. Their tactics enable bypass of standard Windows defenses, facilitating ATM fraud and SWIFT network breaches.

Incidents

1 incident linked to this organisation.