Cobalt Renaissance

Group-IB's report analyses the Cobalt criminal group's large-scale, financially motivated attacks (2016–2018) against banks and related organizations worldwide, describing phishing campaigns spoofing vendors, CobInt reconnaissance backdoors and CobaltStrike loaders, JS backdoors and in-memory info-stealers, a custom PetrWrap ransomware variant, supply-chain compromises, and links to Anunak/Carbanak, and provides extensive indicators (domains, IPs, hashes) and TTPs used in active operations.