Cobalt Kitty

Operation Cobalt Kitty, a significant cyber espionage Advanced Persistent Threat (APT), was executed by the OceanLotus Group, also known as APT32, Canvas Cyclone, APT-C-00, and Cobalt Kitty. Active since at least 2012, the group targeted a global corporation in Asia during this operation. Over the course of the campaign, the attackers successfully compromised more than 40 PCs and servers, including critical infrastructure such as the domain controller, file servers, web application server, and database server. The tools, modus operandi, and indicators of compromise (IOCs) observed in Operation Cobalt Kitty were key to attributing this large-scale cyber espionage APT to the OceanLotus Group. Cybereason conducted an in-depth investigation into Operation Cobalt Kitty, uncovering and analyzing new tools in the OceanLotus Group's attack arsenal. These findings were instrumental in understanding the group's approach and tactics. The unique characteristics of Operation Cobalt Kitty, despite being one part of the group's growing chain of APT campaigns, provided valuable insights into the group's evolving strategies and techniques. As the investigation progressed, some of the IOCs observed in Operation Cobalt Kitty began to appear in the wild, with some even reported as being used in other campaigns. This highlights the dynamic nature of IOCs, which tend to change over time. Nonetheless, these IOCs served as behavioral fingerprints that played a pivotal role in linking Operation Cobalt Kitty to the OceanLotus Group. While Operation Cobalt Kitty is a unique campaign in many respects, it forms a crucial link in the broader context of the group's ongoing APT activities.