{
	"id": "70448fc6-f01b-4fc9-8d96-5b963daee3c4",
	"created_at": "2026-04-06T01:30:00.25592Z",
	"updated_at": "2026-04-10T03:35:12.568504Z",
	"deleted_at": null,
	"sha1_hash": "0a6ccda95a8138c96ce39b6cf8f39478b4f3a18e",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48084,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 00:15:09 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool CobInt\n Tool: CobInt\nNames\nCobInt\nCOOLPANTS\nCategory Malware\nType Downloader\nDescription\n(Proofpoint) CobInt is a downloader malware written in C. Its name is based on the\nassociation of the malware with the “Cobalt Group” threat actor and an internal DLL\nname of “int.dll” used in some of the samples. The malware can be broken up into three\nstages: an initial downloader that downloads the main component, the main component\nitself, and various additional modules.\nInformation\nMalpedia AlienVault OTX Last change to this tool card: 10 July 2020\nDownload this tool card in JSON format\nAll groups using tool CobInt\nChanged Name Country Observed\nAPT groups\n Cobalt Group 2016-Oct 2019\n1 group listed (1 APT, 0 other, 0 unknown)\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5f33f6de-c7c2-4598-884e-96f2720c1db6\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5f33f6de-c7c2-4598-884e-96f2720c1db6\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5f33f6de-c7c2-4598-884e-96f2720c1db6\r\nPage 2 of 2\n\nAPT groups Cobalt Group 2016-Oct 2019 \n1 group listed (1 APT, 0 other, 0 unknown) \n   Page 1 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5f33f6de-c7c2-4598-884e-96f2720c1db6"
	],
	"report_names": [
		"listgroups.cgi?u=5f33f6de-c7c2-4598-884e-96f2720c1db6"
	],
	"threat_actors": [
		{
			"id": "610a7295-3139-4f34-8cec-b3da40add480",
			"created_at": "2023-01-06T13:46:38.608142Z",
			"updated_at": "2026-04-10T02:00:03.03764Z",
			"deleted_at": null,
			"main_name": "Cobalt",
			"aliases": [
				"Cobalt Group",
				"Cobalt Gang",
				"GOLD KINGSWOOD",
				"COBALT SPIDER",
				"G0080",
				"Mule Libra"
			],
			"source_name": "MISPGALAXY:Cobalt",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "2dfaa730-7079-494c-b2f0-3ff8f3598a51",
			"created_at": "2022-10-25T16:07:23.474746Z",
			"updated_at": "2026-04-10T02:00:04.623746Z",
			"deleted_at": null,
			"main_name": "Cobalt Group",
			"aliases": [
				"ATK 67",
				"Cobalt Gang",
				"Cobalt Spider",
				"G0080",
				"Gold Kingswood",
				"Mule Libra",
				"TAG-CR3"
			],
			"source_name": "ETDA:Cobalt Group",
			"tools": [
				"ATMRipper",
				"ATMSpitter",
				"Agentemis",
				"AmmyyRAT",
				"AtNow",
				"COOLPANTS",
				"CobInt",
				"Cobalt Strike",
				"CobaltStrike",
				"Cyst Downloader",
				"Fareit",
				"FlawedAmmyy",
				"Formbook",
				"Little Pig",
				"Metasploit Stager",
				"Mimikatz",
				"More_eggs",
				"NSIS",
				"Nullsoft Scriptable Install System",
				"Pony Loader",
				"Ripper ATM",
				"SDelete",
				"Siplog",
				"SoftPerfect Network Scanner",
				"SpicyOmelette",
				"Taurus Builder",
				"Taurus Builder Kit",
				"Taurus Loader",
				"Terra Loader",
				"ThreatKit",
				"VenomKit",
				"cobeacon",
				"win.xloader"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c11abba0-f5e8-4017-a4ee-acb1a7c8c242",
			"created_at": "2022-10-25T15:50:23.744036Z",
			"updated_at": "2026-04-10T02:00:05.294413Z",
			"deleted_at": null,
			"main_name": "Cobalt Group",
			"aliases": [
				"Cobalt Group",
				"GOLD KINGSWOOD",
				"Cobalt Gang",
				"Cobalt Spider"
			],
			"source_name": "MITRE:Cobalt Group",
			"tools": [
				"Mimikatz",
				"More_eggs",
				"SpicyOmelette",
				"SDelete",
				"Cobalt Strike",
				"PsExec"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775439000,
	"ts_updated_at": 1775792112,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/0a6ccda95a8138c96ce39b6cf8f39478b4f3a18e.pdf",
		"text": "https://archive.orkl.eu/0a6ccda95a8138c96ce39b6cf8f39478b4f3a18e.txt",
		"img": "https://archive.orkl.eu/0a6ccda95a8138c96ce39b6cf8f39478b4f3a18e.jpg"
	}
}