ATT&CK ReferencesProofpoint Cobalt June 2017

Proofpoint Cobalt June 2017

Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.

Open the source

Techniques0

Not cited by any technique.

Groups1

Cobalt Group

Software0

None recorded.

Campaigns0

None recorded.

Procedure examples2

Technique	Used by	Procedure example
T1203 Exploitation for Client Execution	GroupCobalt Group	Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759. Crowdstrike Global Threat Report Feb 2018 PTSecurity Cobalt Dec 2016 PTSecurity Cobalt Group Aug 2017 Proofpoint Cobalt June 2017 RiskIQ Cobalt Jan 2018 RiskIQ Cobalt Nov 2017 Talos Cobalt Group July 2018 TrendMicro Cobalt Group Nov 2017
T1566.001 Spearphishing Attachment	GroupCobalt Group	Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables. Group IB Cobalt Aug 2017 PTSecurity Cobalt Dec 2016 PTSecurity Cobalt Group Aug 2017 Proofpoint Cobalt June 2017 RiskIQ Cobalt Nov 2017 Talos Cobalt Group July 2018 TrendMicro Cobalt Group Nov 2017 Unit 42 Cobalt Gang Oct 2018

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.