Threat actor
Cobalt Group
Tracked by CyberSIXT since 27 Aug 2025
- Articles · all time
- 1
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 2
One article so far, 27 Aug 2025. A pattern appears once more outlets cover Cobalt Group.
Names and sources
- Cobalt
- Named by CyberSIXT coverage
- Cobalt Group
- Named by CyberSIXT coverage
- COBALT SPIDER
- Named by Malpedia · cobalt
- Cobalt
- Named by Malpedia · cobalt
- Cobalt Gang
- Named by Malpedia · cobalt
- Cobalt Group
- Named by Malpedia · cobalt
- G0080
- Named by Malpedia · cobalt
- GOLD KINGSWOOD
- Named by Malpedia · cobalt
All 20 names
- Mule Libra
- Named by Malpedia · cobalt
- COBALT SPIDER
- Named by MISP Galaxy · 01967480-c49b-4d4a-a7fa-aef0eaf535fe
- Cobalt
- Named by MISP Galaxy · 01967480-c49b-4d4a-a7fa-aef0eaf535fe
- Cobalt Gang
- Named by MISP Galaxy · 01967480-c49b-4d4a-a7fa-aef0eaf535fe
- Cobalt Group
- Named by MISP Galaxy · 01967480-c49b-4d4a-a7fa-aef0eaf535fe
- G0080
- Named by MISP Galaxy · 01967480-c49b-4d4a-a7fa-aef0eaf535fe
- GOLD KINGSWOOD
- Named by MISP Galaxy · 01967480-c49b-4d4a-a7fa-aef0eaf535fe
- Mule Libra
- Named by MISP Galaxy · 01967480-c49b-4d4a-a7fa-aef0eaf535fe
- Cobalt Gang
- Named by MITRE ATT&CK® · G0080
- Cobalt Group
- Named by MITRE ATT&CK® · G0080
- Cobalt Spider
- Named by MITRE ATT&CK® · G0080
- GOLD KINGSWOOD
- Named by MITRE ATT&CK® · G0080
Malware and tools
Mimikatz (MITRE ATT&CK® · G0080) PsExec (MITRE ATT&CK® · G0080) Cobalt Strike (MITRE ATT&CK® · G0080) SDelete (MITRE ATT&CK® · G0080) More_eggs (MITRE ATT&CK® · G0080) SpicyOmelette (MITRE ATT&CK® · G0080) More_eggs (Malpedia · cobalt) ATMSpitter (Malpedia · cobalt) Cobalt Strike (Malpedia · cobalt) CobInt (Malpedia · cobalt) Formbook (Malpedia · cobalt) Loki Password Stealer (PWS) (Malpedia · cobalt) Pony (Malpedia · cobalt)
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G0080
Tactics pending refresh
- T1021.001
- Remote Desktop Protocol
- T1027.010
- Command Obfuscation
- T1037.001
- Logon Script (Windows)
- T1046
- Network Service Discovery
- T1053.005
- Scheduled Task
- T1055
- Process Injection
- T1059.001
- PowerShell
- T1059.003
- Windows Command Shell
- T1059.005
- Visual Basic
- T1059.007
- JavaScript
- T1068
- Exploitation for Privilege Escalation
- T1070.004
- File Deletion
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- When Hackers are Quicker than Antiviruses: Cobalt Group Bypasses Antivirus Protectiongroup-ib.com · first in our coverage