Positive Technologies - learn and secure : Cobalt strikes back: an evolving multinational threat to finance

Positive Technologies' 2017 analysis of the Cobalt group describes an evolving multinational financially motivated campaign that uses spear-phishing, compromised partner infrastructure, and Office-document exploits (notably CVE-2017-0199) to deliver Beacon/Cobalt Strike droppers and steal cash (including ATM cash-outs); the report details file types, delivery waves, infrastructure (phishing domains, alexusMailer), geographic targeting, and recommended defensive measures.