Russian Organizations Targeted Using GoRed Backdoor
1. ExCobalt includes former Cobalt Gang members, active since at least 2016.
2. Cobalt Gang attacked financial institutions and used CobInt, adopted by ExCobalt.
3. ExCobalt targets Russian sectors: government, IT, metallurgy, mining, software, telecommunications.
4. Initial access via compromised contractors and supply chain attacks on software.
5. ExCobalt uses Metasploit, Mimikatz, ProcDump, SMBExec, Spark RAT, Linux exploits.
#excobalt
#goredbackdoor
#cyberespionage
#cobaltgang
#positivetechnologies
#vladislavlunin
#alexanderbadayev
#cobint
#russianorganizations
#cyberattacks
#supplychainattack
#metasploit
#mimikatz
#procdump
#smbexec
#sparkrat
#linuxprivilegeescalation
#cve201913272
#cve20213156
#cve20214034
#cve20222586
#sophisticatedthreatactor
#governmentsector
#itsector
#metallurgy
#mining
#softwaredevelopment
#telecommunications
#infectedcomponent
#contractorcompromise
#technicalreport
#goredbackdoor
#cyberespionage
#cobaltgang
#positivetechnologies
#vladislavlunin
#alexanderbadayev
#cobint
#russianorganizations
#cyberattacks
#supplychainattack
#metasploit
#mimikatz
#procdump
#smbexec
#sparkrat
#linuxprivilegeescalation
#cve201913272
#cve20213156
#cve20214034
#cve20222586
#sophisticatedthreatactor
#governmentsector
#itsector
#metallurgy
#mining
#softwaredevelopment
#telecommunications
#infectedcomponent
#contractorcompromise
#technicalreport