On May 23, 1:21 p.m (Moscow time) Group-IB tracked a new large-scale Cobalt cyberattack on the leading banks of Russia and the CIS. It was like a challenge: phishing emails were sent acting as a major anti-virus vendor. Bank employees received a "complaint", in English, that their computers allegedly violated legislation. The users were asked to carefully read the attached email and provide detailed explanations. If a response was not received within 48 hours, the "anti-virus company" threatened to impose sanctions on the recipient's web resources. In order to download the email, the user was asked to follow a link, which would then infect the Bank employee's computer.

On May 23, 2018, phishing emails were sent from the following mailboxes:

•recive@kaspersky-corporate[.]com

•info@kaspersky-corporate[.]com

•r.levis@kaspersky-corporate[.]com

Subject: "Technical Support"

The kaspersky-corporate[.]com domain name was registered on May 21, 2018, and at the moment it is resolved to the IP address 172.217.22[.]110. Previously, it was resolved to 194.58.112[.]174 and 62.76.40[.]207.

The address of the mail server from which the emails were sent, mail.kaspersky-corporate.com, has an IP address: 62.76.40[.]207.

The email contains a link to the Complaint.doc file (hxxps://kaspersky-security[.]com/Complaint.doc). After clicking the link, the user receives .doc exploit, generated by ThreadKit framework.

Complaint.doc

MD5 fa354151a3fc6d0dce69e8eeaa8cd197

Size 192706 bytes

However, the attacker made a mistake and forgot to configure the exploit build, which meant that the exploit was empty and did not install anything in the system. Moreover, the hackers did not change the standard decoy document set by the author by default. After opening an exploit, the error page was displayed.

The Cobalt group first committed thefts through SWIFT in Hong Kong, in the spring of 2016, and then in Ukraine. Millions of dollars were stolen in both cases, which required technologies and contacts with money mules that would be able to transfer large amounts of money withdrawn through SWIFT. These, and other factors, suggest that the group probably did not act on its own.

After the Ukrainian episode, attacks involving the system of interbank transfers suddenly ceased. The Cobalt group switched to attacks on banks through card processing and ATMs, which was much simpler and safer for mules (people who deal with cash withdrawals). Cobalt's first major independent success was the attack on First Bank in Taiwan, where the hackers managed to steal $2.18 million. In September 2016, Cobalt gained access to a bank in Kazakhstan. It took two months to prepare for the attack and explore the bank's infrastructure. In November, Cobalt successfully stole about $600,000 through card processing. These attacks were then perfected and intensified. In 2017 the Cobalt group set "personal best" in attempting to steal EUR25 million from a European bank via card processing.

Cobalt only conducted new attacks on SWIFT 18 months after the April 2016 incidents. In December 2017 for the first time in Russia, they made a successful attack on a bank through SWIFT. This incident was the first SWIFT theft in the history of the Russian banking industry. For a considerable time, Cobalt's continued success was because the hackers constantly tested new tools and schemes, often changing the location of attacks and familiarizing themselves with how internal banking systems functioned. After gaining access to computers on a target bank, Cobalt often spent three to four weeks to study the internal infrastructure of the organization, collecting information about and observing the function of payments systems, and only then conducting their attack. The average damage from each successful attack was 1.5 million USD based on incident response conducted by Group-IB and publicly disclosed estimates from Europol.

In 2018, major strides were made to disrupt Cobalt group's operations when the leader was arrested by Europol and local law enforcement in Alicante, Spain. Following this arrest, Group-IB has continued to monitor new activity from the group, including attacks on March 10th, March 15th and even on the day of the announced arrest, March 26th with spear phishing emails sent to organizations acting as SpamHaus, a non-profit organization that fights against spam.

Group-IB has been investigating targeted attacks and cybercrime for over 15 years. Through incident response and joint investigations with law enforcement, we have monitored joint operations of various cybercriminal groups and the recruitment of individual hackers to commit attacks on banks and other organizations. We expect that this trend will only intensify over the coming years. This report publicly discloses the joint operations of the Cobalt Group and Anunak (Carbanak) which were identified privately before arrests, and provides an overview of their key attacks in the period 2016 - 2017.

In 2016, Group-IB released the first public report on Cobalt providing detailed information on their attacks, which is available online. This attributed the appearance of the Cobalt group with the termination of another infamous gang – Buhtrap. There was a three month break between the last Buhtrap attack and the first Cobalt attack.

In these three months, Cobalt prepared infrastructure and committed thefts through SWIFT in Hong Kong and Ukraine. We were confident that Cobalt was involved in these attacks because of the unique loader (stager). It was found in these incidents and has only been used by Cobalt. However, these attacks as well as their method of cashing out money were surprisingly sophisticated. This indicated that Cobalt group did not act alone. Communication with the Anunak group was discovered only 18 months later (in 2017), when during incident response we detected the same unique SSH backdoor that was employed by the Carbanak group in 2014.

In 2017, Cobalt invested heavily into their technology – from reverse engineering of malware samples, it appears likely they enlisted a team of developers who created new tools for Cobalt group, and adjusted exploits in order to evade detection by security vendors.

Their work allowed Cobalt to act more efficiently: hours after PoCs for 1-day exploits were posted publicly, Cobalt group began using modified versions in attacks on banks and updated them in real time to avoid detection.

New tools and tactics allowed them to attack their targets - SWIFT, card processing, and payment gateways – with more success and set a "personal best" in attempting to steal over 25 million EUR from a European bank via card processing.

A major change in the tactics of Cobalt was the shift towards indirect attacks. In February 2017, we tracked the first successful attack on a system integrator, which was then used as a vehicle by Cobalt for further attacks on companies in Russia, Kazakhstan, Moldova, as well as their subsidiaries in other countries. During the next 9 months, Cobalt infiltrated at least four integrators located in Ukraine, the US, and Russia.

In March 2017, Cobalt began to prepare attacks on companies that provide electronic wallets and payment terminals. In April, they adopted an attack scheme and created a unique program to automatically generate fraudulent payments through payment gateways. In September, the group for the first time attacked an e-wallet vendor and successfully stole funds through a payment gateway. In this incident Group-IB was able to discover clear evidence of Carbanak involvement.

More recently, the group has begun to attack insurance agencies and the media. In these attacks, they obtain control of mail servers or accounts to further use the victim's infrastructure for attacks on banks.

Cobalt returned in 2018 in fine form - both in terms of technology and infrastructure. The March arrest of the Cobalt gang leader in Spain has not yet led to the conclusion of attacks against financial institutions by this group. Remaining members reduced their activity in Russia and the CIS, temporarily focusing on other regions. It is interesting to note that phishing emails, which were tracked in March, purported to be from US companies, for example, IBM, Verifon, Spamhaus:

On March 7-10, letters were sent from the domains ibm-cert.com, ibm-warning.com, ibm- notice.com.

On March 15, a new phishing campaign was detected – hackers employed the dns-verifon. com domain, leveraging the brand of VeriFon, the largest vendor of POS terminals.

On March 26, phishing emails were sent acting as SpamHaus, a well-known non-profit organization that fights against spam and phishing. For this campaign, the attackers registered the spamhuas.com domain, which is indistinguishable from the official one (spamhaus. org).

On April 3, emails sent from the compromised mail server of the Swedish company were tracked.

On May 18, Cobalt sent emails from the name of SWIFT with JS backdoor, previously used in the Cobalt's attack against USA and Europe banks.

On May 23, Group-IB tracked a new large-scale Cobalt cyberattack on the leading banks of Russia and the CIS. It was like a challenge: phishing emails were sent acting as a major anti-virus vendor.

On May 28, hackers sent emails as European Central Bank with JS-backdoor.

Given the technological evolution of the group and the fact that in spite of the arrests of the Cobalt gang leader and malware writer, Cobalt has continued to strike, the most likely scenario is that remaining Cobalt members will join existing groups or a fresh "redistribution" will result in a new cybercriminal organization 'Cobalt 2.0' continuing attacks on banks worldwide.