APT / THREAT GROUP

CobInt

aliases

Last seen:Mar 17, 2026

Intelligence Profile

CobInt, is a self-developed backdoor of the Cobalt group. The modular tool has capabilities to collect initial intelligence information about the compromised machine and stream video from its desktop. If the operator decides that the system is of interest, the backdoor will download and launch CobaltStrike framework stager. It's CRM mailslot module was also observed being downloaded by ISFB.

Threat Analysis

CobInt is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://www.secureworks.com/research/threat-profiles/gold-kingswood

→https://asert.arbornetworks.com/double-the-infection-double-the-fun/

→https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf

→https://www.group-ib.com/blog/renaissance

→https://www.netscout.com/blog/asert/double-infection-double-fun

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

COOLPANTSwin.cobintCobInt

External Intelligence

Malpedia: win.cobint

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search CobInt