iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In August 2018, the Cobalt Group targeted Russian NS Bank and Romania’s Banca Comercială Carpatica, which had merged with Patria Bank the year before, using phishing emails that impersonated financial organizations. Public reporting documented attempted initial access, not a confirmed breach of either bank.
What happened in the August 2018 campaign?
NETSCOUT’s ASERT threat-intelligence team reported observing the campaign on 13 August 2018. The emails were tailored to look as though they came from a financial supplier or partner—a tactic intended to make recipients more likely to trust and open the message or its attachments.
In the Russian targeting, the sender impersonated the payment company Interkassa. A related operation against the Romanian institution posed as the Single Euro Payments Area (SEPA). NETSCOUT identified the targeted Romanian domain as belonging to Banca Comercială Carpatica, which merged with Patria Bank in 2017. The campaign was therefore reported as targeting Carpatica; that historical name should not be taken to mean the report established a compromise of Patria Bank.
How did the phishing email deliver malware?
The observed NS Bank message included two malicious URLs, giving the recipient two separate ways to retrieve a payload:
#1 Best Overall
- One URL returned a weaponized Word document containing obfuscated Visual Basic for Applications (VBA) code. The document was designed to exploit a recipient opening it and enabling or otherwise running its malicious content.
- The other returned an executable file disguised with a
.jpgextension. The image-like filename could make the file appear less suspicious, but the reported payload was an executable, not an image.
The two-link arrangement was notable because it offered alternative delivery routes in a single message. NETSCOUT and SecurityWeek described the campaign’s phishing and malware activity, but the public account does not establish how many recipients opened either link or executed a payload.
What malware and infrastructure were associated with Cobalt?
ASERT attributed the activity to Cobalt based on several indicators considered together: phishing style, look-alike financial domains, command-and-control (C2) infrastructure associated with the group, and similarities between the analyzed malware and tools linked to earlier Cobalt activity. This is a threat-intelligence attribution, not proof that any one indicator by itself identifies an operator.
Backdoors and capabilities
The analyzed samples included a JavaScript backdoor and the reconnaissance backdoor COOLPANTS, also called CobInt in related reporting. SecurityWeek described the JavaScript backdoor as “more_eggs.” Its reported commands could download and execute a payload, update or remove itself and related registry entries, launch a replacement copy, and run a command through cmd.exe. Those capabilities could support continued access or further activity after an initial foothold; the reporting does not show that every capability was used against either bank.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Technical reporting also described a sample compiled on 1 August 2018 that closely matched COOLPANTS functions and connected to a Cobalt-linked C2 domain. Reported look-alike domains included compass.plus, eucentalbank.com, europecentalbank.com, inter-kassa.com and unibank.credit. Their resemblance to financial organizations or services could help make phishing infrastructure appear credible.
Rank #3
Were NS Bank or the Romanian bank breached?
Not according to the evidence reported publicly at the time. CyberScoop quoted Richard Hummel, then threat research manager with Arbor Networks, saying researchers had not seen evidence that either bank’s network had been breached. The evidence pointed to attempted initial footholds. The presence of backdoors indicates tools capable of enabling later operations, but it does not establish successful access, data theft, or financial loss from either named target in this campaign.
That distinction matters: a targeted email, a delivered payload, an executed payload, and a confirmed network compromise are separate stages. The 2018 reporting established targeting and described malware analysis; it did not publicly confirm the later stages for these banks.
How does the campaign fit Cobalt’s earlier activity?
SecurityWeek reported that Cobalt had been tracked since at least 2016 and summarized earlier alleged activity: a $9.7 million theft from Russia’s MetakkinvestBank, $2.18 million in ATM thefts from Taiwanese banks, a SWIFT attack on Russian banks, and more than 200 attacks on banks in Europe, Thailand, Turkey and Taiwan. These are historical claims as summarized by SecurityWeek, not independently audited totals established by the campaign report.
Free tools Windows power users keep installed
One-click scans. No signup required.
Separately, Group-IB reported Cobalt attacks against banks and financial-sector organizations in Russia and the Commonwealth of Independent States, and described use of the Coblnt Trojan in earlier operations. Together, these accounts place the 2018 phishing activity in a broader pattern of financial-sector targeting, but they do not establish that the same operators or tools were involved in every incident attributed to Cobalt.
Best Value
What the campaign shows about bank-targeting phishing
The operation combined familiar social engineering—impersonating a financial counterparty—with more than one malware-delivery route and infrastructure made to resemble legitimate financial entities. For defenders, the practical lesson is to assess sender identity and links independently, scrutinize unexpected documents and executable files (including files whose extensions disguise their type), and investigate suspicious outbound connections for signs of backdoor communication. These are defensive implications of the reported techniques, not evidence that the named banks did or did not take particular measures.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
