Threat Actor Unknown origin

Cobalt

Also known as: Cobalt Group · Cobalt Gang · GOLD KINGSWOOD · COBALT SPIDER · G0080 · Mule Libra

A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.

MITRE ATT&CK TTPs 16

T1003
OS Credential Dumping
Credential Access
 T1005
Data from Local System
Collection
 T1021
Remote Services
Lateral Movement
 T1040
Network Sniffing
Credential Access
 T1056.001
Keylogging
Collection
 T1059
Command and Scripting Interpreter
Execution
 T1059.001
PowerShell
Execution
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1074
Data Staged
Collection
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1110
Brute Force
Credential Access
 T1123
Audio Capture
Collection
 T1203
Exploitation for Client Execution
Execution
 T1566
Phishing
Initial Access

Source Articles

Golden Chickens Resurfaces With Four New Malware Families and Modular Implants
The Golden Chickens threat actor, tracked as TAG-195, has resurged with four new malware families: TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and ChromEggscalator. These tools represent an evolution toward modular, operator-driven malware architectures designed for defense evasion and flexible post-compromise operations. The group uses ClickFix-style social engineering to deploy payloads, establishing persistent access and enabling browser theft, surveillance, and remote execution. The malware communicates via WebSockets to C2 servers and leverages shared infrastructure and techniques across families.
hacker-news ·4d ago