ExCobalt
ExCobalt is a threat actor cited as conducting campaigns against Russian organizations. Reported initial access methods include leveraging known security vulnerabilities and using credentials stolen from contractors. Post-compromise activity includes credential theft targeting Telegram (credentials and message history) and Outlook Web Access (via malicious code injection into the login page). Tooling associated with ExCobalt includes the CobInt backdoor, use of lockers such as Babuk and LockBit, and a kernel-mode rootkit family described as PUMAKIT (used for privilege escalation, hiding files/directories, and self-concealment), with prior iterations named Facefish (Feb 2021), Kitsune (Feb 2022), and Megatsune (Nov 2023). ExCobalt is also associated with a Rust-based Linux privilege-escalation toolkit called Octopus. Positive Technologies characterized ExCobalt as one of the “most dangerous groups” attacking Russian entities and noted a shift from exploiting 1-day vulnerabilities in internet-exposed services (e.g., Microsoft Exchange) toward reaching primary targets via contractors.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Campaigns targeting Russian organizations using exploitation of known vulnerabilities and use of stolen credentials.
Targets Russian organizations; gains initial access by exploiting known vulnerabilities and using contractor-stolen credentials; conducts credential theft (Telegram/OWA) and uses a mix of backdoors, rootkits, and ransomware lockers.
Targets Russian organizations; gains initial access via exploitation of known vulnerabilities and use of contractor-stolen credentials; conducts credential theft (Telegram and OWA) and uses a mix of backdoors, rootkits, and ransomware lockers.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.