Cobalt is a threat actor, also known as Cobalt Group, Cobalt Gang, G0080. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Cobalt exploit?

Cobalt is known to exploit 8 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

Cobalt

Also known as: Cobalt Group, Cobalt Gang, G0080, Gold Kingswood, Mule Libra, Cobalt Spider, COBALT SPIDER, TAG-CR3, ATK 67, GOLD KINGSWOOD

Financial crime

Exploited CVEs

Overview

A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.

Exploited Vulnerabilities

CVE ID	Action
CVE-2017-8759	View Details