ExCobalt

Reports per quarter

Techniques seen in the last two years

• T1014 1 report
• T1021.004 1 report
• T1027.009 1 report
• T1027.011 1 report
• T1027.015 1 report
• T1030 1 report
• T1036 1 report
• T1036.005 1 report
• T1041 1 report
• T1056.004 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2019-13272 KEV
• CVE-2021-3156 KEV
• CVE-2021-4034 KEV ransomware
• CVE-2022-2586 KEV
• CVE-2022-2588
• CVE-2023-4911 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 2 December 2025

   (Ex)Cobalt. Обзор инструментов группы в атаках за 2024–2025 годы

   Malpedia library date fromORKL

   The original link failed its last check. Original publisher Detailsfor (Ex)Cobalt. Обзор инструментов группы в атаках за 2024–2025 годы

2. 18 June 2024

   ExCobalt: GoRed, the hidden-tunnel technique

   Malpedia library date fromORKL

   The original link failed its last check. Original publisher Detailsfor ExCobalt: GoRed, the hidden-tunnel technique

Newest first. Details opens the report in Explore.