The threat group known as Cobalt Gang is using a new downloader called CobInt to infect and subsequently install additional malware on systems of interest.
In August and Sept, we discovered four separate financially intended attack campaigns from cobalt Gang. every of the operations used malicious URLs and Microsoft Word documents to transfer the primary stage of CobInt malware.
For this section, a basic downloader put in the most malware component. That part was chargeable for capital punishment numerous modules within the subsequent stage.
Researchers discovered 2 modules at the time of discovery. One allowed the malware to send a screenshot to its command-and-control (C&C) server, and another enabled it to make and transfer an inventory of running processes on the infected machine. Even so, we reasoned that CobInt possible masses up further modules on systems of interest when it completes its intelligence activity stages.
What’s Driving the Rise of Malicious Downloaders?
Cobalt Gang stopped using CobInt in May 2018 before picking it up again two months later. This return coincided with a rise in the use of downloaders to initially infect machines, conduct reconnaissance and install additional malware, as evidenced by Secnic’s discovery of two other downloaders, Marap and Advisorsbot, in August.
Aside from those findings, two additional malware families with downloader capabilities made second and third place in Check Point’s “Most Wanted Malware” list for August 2018. Check Point also tracked a growth of banking Trojan activity for August, with malicious downloaders helping to fuel this development.
How to Defend Against CobInt and Other Downloaders
Security professionals can defend their organizations against downloaders like CobInt by embracing artificial intelligence (AI)solutions to aid in threat detection and conduct cyber deception to misdirect and deactivate evasive malware. IBM experts also recommend monitoring and analyzing how apps behave across user devices and flagging anomalous behavior to nip future attacks in the bud.