Group IB Cobalt Aug 2017

Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.

Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.

Cobalt Group has created Windows tasks to establish persistence.

Cobalt Group has injected code into trusted processes.

Cobalt Group has used powershell.exe to download and execute scripts.

Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files.

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.

Cobalt Group has executed JavaScript scriptlets on the victim's machine.

Cobalt Group has used exploits to increase their levels of rights and privileges.

Cobalt Group has used HTTPS for C2.

Cobalt Group has used DNS tunneling for C2.

Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.

Cobalt Group has created new services to establish persistence.

Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.

Cobalt Group has bypassed UAC.

Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.

Cobalt Group has used the Plink utility to create SSH tunnels.

Cobalt Group has used the Plink utility to create SSH tunnels.