Secrets of Cobalt

In June 2016, the first attack conducted by the Cobalt group was tracked at a large Russian bank, where hackers attempted to steal money from ATMs. The attackers infiltrated the bank’s network, gained control over it, compromised the domain administrator’s account, and reached the ATM control server.

The Bank’s Information Security team detected traces of malicious programs and suspicious connections to the server. In order to stop further unauthorized access, the entire bank was blocked from accessing the Internet. This turned out to be the best solution, as the Cobalt group set up a controlled botnet in the bank’s network which was very difficult to track and even harder to stop.

The day after the attack, Group-IB experts came…