Threat actorMultiple (Russia, North Korea)Tracked since 2026-02

Cobalt Group

Also known as:Cobalt GangCobalt SpiderGOLD KINGSWOODAPT43Black BansheeEarth KumihoEmerald SleetG0086Operation Stolen PencilPatheticSlugSparkling PiscesSpringtail

As of 2026-05-30, Cobalt Group is a Multiple (Russia, North Korea)-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning phishing. Also known as Cobalt Gang, Cobalt Spider, GOLD KINGSWOOD, APT43.

Tracked threats

11 high

First seen

2026-022026-02-16

Last seen

2026-022026-02-16

ATT&CK techniques

—No mapped techniques yet

Related CVEs

0None referenced

Attribution

Multiple (Russia, North Korea)Nation or origin