Cobalt__2017__Cobalt-2017-eng.pdf

This Positive Technologies report analyzes the 2017 Cobalt campaign: a multinational, financially motivated threat actor that used partner-compromises and supply‑chain phishing to deliver exploit-based Microsoft Office documents (including CVE-2017-0199), password-protected archives, LNK droppers and Beacon (Cobalt Strike) implants to compromise banks and financial organizations globally, describing their targets, timelines, infrastructure, filetypes, and recommended defenses.