Cobalt Group Case Study: How Hackers Attacked Banks and What Destroyed Them

[Cloned Boy]

Cobalt Group is one of the most dangerous cybercriminal groups of the 2010s, specializing in attacks on banks through targeted malware and hacking of interbank systems. Their activities resulted in hundreds of millions of dollars in damage before key members were arrested.

Who is Cobalt Group?​

Origin and Purposes​

• They operated from 2013 to 2018, mainly in Eastern Europe and the CIS.
• The main goal is to steal money through SWIFT, ATM jackpots and accounting manipulations.
• Associated with other groups (Carbanak, MoneyTaker).

Attack Methods​

1. Phishing and targeted emails
   • They sent out malicious documents (Word, Excel) with macros.
   • They used fake letters from regulators (the Central Bank, tax authorities).
2. Malware: Cobalt Strike & Mispadu
   • Cobalt Strike is a legitimate pentesting tool, but hackers used it for remote access.
   • Mispadu is a Trojan for stealing banking data.
3. Attacks on SWIFT and interbank systems
   • They infiltrated banking networks and changed transfer details.
   • Used fake payment orders (for example, transfers to fictitious accounts).
4. ATM jackpot
   • By hacking processing centers, they gave commands to ATMs to dispense money.

How did they stop them?​

1. Coordination between countries (2018–2020)​

• Europol, the FBI and the Russian Ministry of Internal Affairs jointly monitored the group's activities.
• Analysis of the malicious code showed a connection with Russian-speaking hackers.

2. Hackers' mistakes​

• Using the same C&C servers (identified by IP).
• Communication via unencrypted channels (for example, mail on public services).
• Code leaks (Russian-language comments, traces in metadata).

3. Arrests (2020–2021)​

• Spain, Russia, Ukraine: more than 30 people detained.
• The main defendants received sentences ranging from 5 to 12 years in prison.

Results and consequences​

• Damage: $300+ million (according to Europol).
• Changes in banking security:
  • Strengthening control over SWIFT transfers.
  • Mandatory two-factor authentication for access to payment systems.
  • More stringent monitoring of ATM networks.

What did this case teach us?​

1. Even advanced hackers leave traces (logs, metadata, OpSec bugs).
2. International cooperation works (without Europol, arrests would not have been possible).
3. Banks are vulnerable to social engineering - employee training is critical.

Want another case study? For example, Lazarus Group (attacks on crypto exchanges)?