Threat Actor Cobalt

By Ashwin Venugopal -

 










Introduction

This threat actor is also known as COBALT SPIDER, Cobalt Gang, Cobalt Group, G0080, GOLD KINGSWOOD, and Mule Libra. This criminal group is dubbed as Cobalt. It was behind the synchronized ATM heists, in which machines across Europe, CIS countries (including Russia), and Malaysia were simultaneously raided within few hours. Cobalt has been active since 2016 and recently attacked in July and August.

Hence, from the above statements, Cobalt Group is a financially motivated threat group that primarily targets financial institutions. It has targeted Eastern Europe, Central Asia, and Southeast Asia. This threat group is known to target organizations in order to use their access to then compromise additional victims. Reportedly, they might have linked with both the malware Carbanak and the group Carbanak, Anunak. 

Features

Cobalt Strike, a threat emulation program have following capabilities: 

  • Reconnaissance- To discover client-side software with version info to recognize known vulnerabilities. 

  • Attack Packages-  This offers a social engineering attack engine and creates trojans that can impersonate as innocent files like Java Applets, Microsoft Office documents or Windows programs, and also provides a website clone to enable drive-by downloads.

  • Collaboration- Its server can share information with a group of attackers, communicate in real time, and share control of compromised systems. 

  • Post Exploitation- It make use of a dropper, called Beacon, that can deploy PowerShell scripts, log keystrokes, take screenshots, download files, and execute other payloads.

  • Covert Communication- It allows the attackers to modify the network indicators on the fly. This helps in loading C2 profiles to appear like another actor, and egress into a network via HTTP, HTTPS, DNS or SMB protocol.

  • Browser Pivoting- It is used to get around two-factor authentication. 

Protection

Cobalt Strike can exploit a wide range of vulnerabilities along with the various attack vectors. Hence, defending against its attack requires a multi-pronged strategy. Some of the strategies that can be implemented are: 
  • Monitor Network- This can offer early warning of a Cobalt Strike attack. Monitoring network means keeping a close eye on the network traffic for any unusual or suspicious activity. It helps in detecting the threat actor in early stages before it can cause significant damage to the system.

  • Detect Anomaly- It is a more advanced form of network monitoring. It specifically keep an eye on the abnormal deviations from the usual behavior. It is very much helpful in detecting the stealthy Cobalt Strike, that may not trigger the traditional security alerts.

  • Access Control and Network Segmentation- It is also an effective defense system. As the name suggests, it divides the network into separate segments to limit the spread of an attack. It hinders the attacker from easily moving onto the other parts of the network, even if one segment is compromised. 

  • Access Control- It can strictly control who can have access and to what extent. It means implementing the Principle of Least Privilege (PoLP), in which users are granted necessary privileges only, to complete their tasks. 

  • Threat Hunting- It means searching for the threats that may have escaped the existing security measures. Regular threat hunting is helpful in identifying the signs of Cobalt Strike as well as the other malicious threat groups. 

  • Incident Response- This is used after the successful detection of a threat actor. A nicely prepared incident response plan can help in mitigating the effects of Cobalt Strike. This plan must include the steps to be taken after a security incident, like how to isolate the affected systems, how to remove the threat, and how to restore normal operations. 

  • Managed Detection and Response (MDR)- This approach combines technology and human expertise. It can easily identify a threat actor according to its known characteristics and behaviors. After that, MDR acts swiftly to mitigate the effects of the attack to stop any further quick damages to the system. It can also offer an expert advise and guidance, that can help immensely in planning an effective defense strategy.




















































































































Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different groups of computers, re
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning of alert rule parameter
Read more

Design Planning (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Complex Organizational Structures SIEM can be an expensive security control, hence, it is common multiple businesses to contribute to the overall expense. Various organizational units may require a level of access to specific dashboards or sets of data. Microsoft Sentinel offers the ability to assign table-level permissions and limit the level of access to the minimum required to perform requisite job functions.  Role-based Access Control (RBAC) Requirements Microsoft Sentinel offers an extensive list of Azure built-in roles that can be used to provide granular access according to the job requirements and permitted level of access. Some of them are various Microsoft Sentinel dedicated roles: Microsoft Sentinel Contributor- Can perform all engineering-related configuration, such as creating alert rules, configuring data connectors, and additional similar tasks.  Microsoft Sentinel Reader- Can query the log data stor
Read more