APT / THREAT GROUP

Cobalt

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.

Threat Analysis

Cobalt is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning Cobalt

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

The Hacker News· Jun 26, 2026

Trust in Automated AI Vulnerability Scanning Collapses to 9%, New Study Finds

Infosecurity Magazine· Jun 25, 2026

StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader

Securelist (Kaspersky)· Jun 24, 2026

KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

The Hacker News· May 26, 2026

Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

The Hacker News· May 14, 2026

2025 Year in Review: Malicious, Infrastructure

Recorded Future Blog· Mar 18, 2026

APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2

The Hacker News· Mar 4, 2026

The Notepad++ supply chain attack — unnoticed execution chains and new IoCs

Securelist (Kaspersky)· Feb 3, 2026

External References

→https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/

→https://www.bleepingcomputer.com/news/security/cobalt-hacking-group-tests-banks-in-russia-and-romania/

→https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish

→https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-september-cobalt-spider/

→https://www.group-ib.com/blog/cobalt

→https://www.reuters.com/article/us-taiwan-cyber-atms/taiwan-atm-heist-linked-to-european-hacking-spree-security-firm-idUSKBN14P0CX

→https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target

→https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/

→https://www.riskiq.com/blog/labs/cobalt-strike/

→https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/

Quick Facts

TypeAPT / Threat Group

Aliases7

SourceMalpedia

Also Known As

Mule LibraCobalt GroupCobaltCOBALT SPIDERG0080Cobalt GangGOLD KINGSWOOD

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Cobalt