ATT&CK ReferencesRiskIQ Cobalt Jan 2018

RiskIQ Cobalt Jan 2018

Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1059.001 PowerShell	GroupCobalt Group	Cobalt Group has used powershell.exe to download and execute scripts. Group IB Cobalt Aug 2017 PTSecurity Cobalt Dec 2016 PTSecurity Cobalt Group Aug 2017 RiskIQ Cobalt Jan 2018 Talos Cobalt Group July 2018 TrendMicro Cobalt Group Nov 2017
T1203 Exploitation for Client Execution	GroupCobalt Group	Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759. Crowdstrike Global Threat Report Feb 2018 PTSecurity Cobalt Dec 2016 PTSecurity Cobalt Group Aug 2017 Proofpoint Cobalt June 2017 RiskIQ Cobalt Jan 2018 RiskIQ Cobalt Nov 2017 Talos Cobalt Group July 2018 TrendMicro Cobalt Group Nov 2017

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.