September 20, 2018 By David Bisson 2 min read

The threat group known as Cobalt Gang is using a new downloader called CobInt to infect and subsequently install additional malware on systems of interest.

In August and September, Proofpoint observed four separate financially motivated attack campaigns from Cobalt Gang. Each of the operations used malicious URLs and Microsoft Word documents to download the first stage of CobInt malware.

For this phase, a basic downloader installed the main malware component. That element was responsible for executing various modules in the subsequent stage.

Researchers observed two modules at the time of discovery. One allowed the malware to send a screenshot to its command-and-control (C&C) server, and another enabled it to create and transfer a list of running processes on the infected machine. Even so, Proofpoint reasoned that CobInt likely loads up additional modules on systems of interest after it completes its reconnaissance stages.

What’s Driving the Rise of Malicious Downloaders?

According to Proofpoint, Cobalt Gang stopped using CobInt in May 2018 before picking it up again two months later. This return coincided with a rise in the use of downloaders to initially infect machines, conduct reconnaissance and install additional malware, as evidenced by Proofpoint’s discovery of two other downloaders, Marap and Advisorsbot, in August.

Aside from those findings, two additional malware families with downloader capabilities made second and third place in Check Point’s “Most Wanted Malware” list for August 2018. Check Point also tracked a growth of banking Trojan activity for August, with malicious downloaders helping to fuel this development.

How to Defend Against CobInt and Other Downloaders

Security professionals can defend their organizations against downloaders like CobInt by embracing artificial intelligence (AI) solutions to aid in threat detection and conduct cyber deception to misdirect and deactivate evasive malware. IBM experts also recommend monitoring and analyzing how apps behave across user devices and flagging anomalous behavior to nip future attacks in the bud.

Sources: Proofpoint, Proofpoint(1), Check Point

More from

How I got started: Incident responder

3 min read - As a cybersecurity incident responder, life can go from chill to chaos in seconds. What is it about being an incident responder that makes people want to step up for this crucial cybersecurity role?With our How I Got Started series, we learn from experts in their field and find out how they got started and what advice they have for anyone looking to get into the field.In this Q&A, we spoke with IBM’s own Dave Bales, co-lead X-Force Incident Command…

Zero-day exploits underscore rising risks for internet-facing interfaces

3 min read - Recent reports confirm the active exploitation of a critical zero-day vulnerability targeting Palo Alto Networks’ Next-Generation Firewalls (NGFW) management interfaces. While Palo Alto’s swift advisories and mitigation guidance offer a starting point for remediation, the broader implications of such vulnerabilities demand attention from organizations globally.The surge in attacks on internet-facing management interfaces highlights an evolving threat landscape and necessitates rethinking how organizations secure critical assets.Who is exploiting the NGFW zero-day?As of now, little is known about the actors behind the…

How TikTok is reframing cybersecurity efforts

4 min read - You might think of TikTok as the place to go to find out new recipes and laugh at silly videos. And as a cybersecurity professional, TikTok’s potential data security issues are also likely to come to mind. However, in recent years, TikTok has worked to promote cybersecurity through its channels and programs. To highlight its efforts, TikTok celebrated Cybersecurity Month by promoting its cybersecurity focus and sharing cybersecurity TikTok creators.Global Bug Bounty program with HackerOneDuring Cybersecurity Month, the social media…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today