A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | Cobalt Group |
| OSINT | Cobalt Gang |
| OSINT | GOLD KINGSWOOD |
| OSINT | COBALT SPIDER |
| OSINT | G0080 |
| OSINT | Mule Libra |
Top 19 by how many reports mention them.
Every report in the Global Intel Library that names Cobalt, newest first. Open any report to see the full analysis with provenance.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Cobalt. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.