MALWARE FAMILY

CobInt

Internal ID: win.cobint

aliases

Last seen:Mar 17, 2026

Intelligence Profile

CobInt, is a self-developed backdoor of the Cobalt group. The modular tool has capabilities to collect initial intelligence information about the compromised machine and stream video from its desktop. If the operator decides that the system is of interest, the backdoor will download and launch CobaltStrike framework stager. It's CRM mailslot module was also observed being downloaded by ISFB.

Threat Analysis

CobInt is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://www.secureworks.com/research/threat-profiles/gold-kingswood

→https://asert.arbornetworks.com/double-the-infection-double-the-fun/

→https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf

→https://www.group-ib.com/blog/renaissance

→https://www.netscout.com/blog/asert/double-infection-double-fun

→https://www.proofpoint.com/us/threat-insight/post/new-modular-downloaders-fingerprint-systems-part-3-cobint

→https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/cobalt_upd_ttps/

→https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf

→https://www.secureworks.com/research/threat-profiles/gold-kingswood

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.cobint

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search CobInt