Cobalt

Cobalt is a Windows-based malware toolkit in the Anunak/Carbanak lineage used in financially motivated intrusions against banks and other financial institutions. By late 2016, the tooling had evolved from earlier Anunak and Carbanak operations into the toolkit commonly tracked as Cobalt. It has been associated with attacks targeting ATM infrastructure, SWIFT and other payment systems, and broader bank internal networks.

Cobalt functions as a remote-access backdoor used to establish and maintain control over compromised systems inside financial environments. Reported capabilities in this lineage include remote control, keylogging, screen capture and screen-video recording, command-and-control communications over web protocols, transfer of additional files and tools, and movement to other internal systems to reach payment-processing, card-processing, and ATM-management assets. Operators have historically used prolonged post-compromise reconnaissance to observe employee workflows and imitate legitimate banking operations before monetization.

Intrusions associated with this malware family have relied on targeted spearphishing of bank employees, including weaponized Microsoft Office documents exploiting known vulnerabilities for initial execution. Once established, operators used the access to support fraudulent transfers, ATM cash-out schemes, and other bank-focused post-exploitation activity. The malware and tradecraft are closely associated with the broader Carbanak/Cobalt criminal ecosystem rather than a confirmed state-sponsored actor set.

Cobalt is best understood as a specialized financial-intrusion toolkit and successor stage in the Carbanak malware lineage, notable for enabling stealthy, hands-on-keyboard compromise of banking networks and payment operations.