Loading threat actor…
ExCobalt is a cyberespionage-focused threat group targeting Russian organizations in metallurgy, mining, telecommunications, information technology, software development, and government. Its membership includes operators active since at least 2016. Shedding Zmiy is an associated activity cluster, while tooling overlaps also connect ExCobalt activity with Sneaking Leprechaun; these relationships do not establish that the groups are identical. No country of origin or state sponsorship is established. ExCobalt obtains initial access by exploiting known vulnerabilities in internet-facing corporate services and using credentials stolen from contractors to penetrate target networks. Its operations employ credential harvesting, reconnaissance, network scanning, privilege escalation, lateral movement, and remote administration. Tools include Mimikatz, ProcDump, SMBExec, Metasploit, web shells, and exploits for Linux privilege-escalation vulnerabilities. Credential collection includes monitoring password data, stealing Telegram credentials and message history, and injecting malicious code into Outlook Web Access login pages. The group's backdoors include CobInt and GoRed. GoRed is a Go-based multifunctional backdoor supporting service-based persistence, host and network reconnaissance, filesystem and credential monitoring, remote command execution, reverse shells, SOCKS proxying, reverse port forwarding, and encrypted data exfiltration. Its communications support WebSocket, QUIC, DNS, and ICMP transports. ExCobalt conceals activity using obfuscation, rootkits, and modified Linux process and network-monitoring utilities that hide malicious processes and connections. Its tooling also includes privilege-escalation frameworks and Babuk and LockBit lockers.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
29 malware families Mallory has associated with this actor across public reporting.
24 additional families tracked in Mallory.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
119 indicators attributed to this actor. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.