Skip to Content
Get started
Open search

Threat profiles

Explore the latest threat group definitions and profiles published by the 

Sophos® Counter Threat Unit™ (CTU) Research Team.

Showing 61-70 of 197 profiles
NameLocationObjectivesAliasesTools
COBALT ILLUSION
COBALT ILLUSION iconIran
Espionage, Surveillance
Agent Serpens (Palo Alto), APT35 (Mandiant), APT42 (Mandiant), Charming Kitten (CrowdStrike), CharmingCypress (Volexity), Educated Manticore (Checkpoint), ITG18 (IBM), Magic Hound (Palo Alto), Mint Sandstorm sub-group (Microsoft), NewsBeef (Kaspersky), Newscaster (iSight), PHOSPHORUS sub-group (Microsoft), TA453 (Proofpoint), UNC788 (Mandiant), Yellow Garuda (PwC)
Browser Exploitation Framework (BeEF), MagicHound Toolset, PupyRAT
COBALT JUNO
COBALT JUNO iconIran
Espionage
APT-C-38 (QiAnXin), SABER LION, TG-2884 (SCWX CTU)
HARDCANDY, SABER1, SABER2, ZooPark
COBALT KATANA
COBALT KATANA iconIran
Espionage
Hive0081 (IBM), SectorD01 (NHSC), xHunt campaign (Palo Alto)
CASHY200, Diezen, Eye, Gon, Hisoka, Hisoka Netero, HyphenShell, Killua, Sakabota, Sakabota Framework
COBALT LYCEUM
COBALT LYCEUM iconIran
Espionage
DEV-0133 (Microsoft), HEXANE (Dragos), ScorchedEpoch (Crowdstrike)
DanBot, MilanRAT, RGDoor, SharkWork RAT
COBALT MIRAGE
COBALT MIRAGE iconIran
Disruption, Espionage, Financial Gain
DEV-0270 (Microsoft), Nemesis Kitten (Crowdstrike), PHOSPHORUS (Microsoft), TunnelVision (SentinelOne), UNC2448 (Mandiant)
BitLocker, Custom powershell scripts, DiskCryptor, Drokbk, Fast Reverse Proxy (FRP), FRPC, Impacket wmiexec, Ngrok, Plink, PowerLessCLR, TunnelFish
COBALT MYSTIQUE
COBALT MYSTIQUE iconIran
Data Theft, Disruption, Espionage
Banished Kitten (Crowdstrike), DEV-0842 (Microsoft), Druidfly (Symantec), Handala Hack Team, Homeland Justice, Karmabelow80, Red Sandstorm (Microsoft), Storm-0842 (Microsoft), Void Manticore (Checkpoint)
AllinOneNeo, Bibi, GramPy, GramPyLoader
COBALT OBELISK
COBALT OBELISK iconIran
Disruption, Influence Operations
ChaoticOrchestra (Crowdstrike), Cotton Sandstorm (Microsoft), Haywire Kitten (Crowdstrike), Marnanbridge (Google), MarnanBridge (Google)
COBALT SAPLING
COBALT SAPLING iconIran
Disruption, Hack and Leak, Ransomware
Abraham's Ax (Hacktivist persona), DEV-0500, Marigold Sandstorm (Microsoft), Moses Staff (Hacktivist persona), Vengeful Kitten (Crowdstrike)
DCSrv, PyDcrypt, StrifeWater RAT
COBALT SHADOW
COBALT SHADOW iconIran
Disruption, Hack and Leak, Ransomware
Agonizing Serpens (Palo Alto), Agrius, Agrius (SentinelOne), AMERICIUM (Microsoft), BlackShadow, DEV-0227 (Microsoft), Justice Blade (persona), Malek Team, Malek Team (persona), MoneyBird (persona), Pink Sandstorm (Microsoft), Sharp Boyz (persona), Spectral Kitten (Crowdstrike)
Apostle, DEADWOOD, Fantasy wiper, Host2IP, IPsec Helper, Jennlog Loader, MiniDump, Moneybird ransomware, Plink, PsExec, Sandals, SecretsDump, SoftPerfect Network Scanner
COBALT SMOKEY
COBALT SMOKEY iconIran
Espionage
Nimbus Manticore (Check Point), Smoke Sandstorm (Microsoft), Subtle Snail (Prodaft), TA455 (ClearSky), UNC1549 (Mandiant/Google)
LIGHTRAIL, MINIBIKE, MINIBUS