We would very much like to give you a review of the "tomato gose," but on Friday you voted for a new analysis of (Ex)Cobalt...

We would very much like to give you an overview of “tomato gose,” but on Friday you voted for a new analysis of (Ex)Cobalt… 🙄

This is one of the most active and dangerous groups attacking Russian organizations to steal confidential data and destroy infrastructure.

Alongside well-known and proven tools — the Cobint backdoor, Babuk and Lockbit encryptors, and various network tunnels — the group continues to create and develop new means, such as Pumakit and Octopus 🐙

An overview of the group’s tools used in attacks during 2024–2025 can be found in our article.

#dfir #ir #linux #ti #malware
@ptescalator