This turned out to be the best solution, as the Cobalt group set up a controlled botnet in the bank's network which was very difficult to track and even harder to stop. In october 2016 Group-IB published the report about the Cobalt group. Initially the Cobalt group focused on jackpotting ATMs: they launched a program that sent commands directly to the dispenser to issue cash. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. When opening the document, the user must click on the "Enable content" button, which enables macros (fig. 5 Example of an email message with a Word document, which, when opened, requires the user to click on the "Enable content" button to enable a malicious macro. 6 Example of a message sent by attackers from a domain whose name is similar to the name of a real domain . As soon as the attachment is launched and the malicious code is executed, the Cobalt Strike payload is loaded in the memory. In addition, Cobalt Strike enables users not to expose a fragment of memory allocated in the context of another process, the RWX (Read, Write, Execute) attributes, which often reveal injected code