Cobra Carbon System
Aliases: Carbon
- First seen
- 2017-01-01 00:00:00
- Malware type
- rat
- Family
- Malware family
- Last IoC activity
- 2026-07-15 16:45:04
- Profile updated
- 2026-07-07 12:40:31
Targeted industries: government-and-public-sector financial-services
Targeted regions: country_code:ru country_code:ua
Context
Cobra Carbon System, also known as Carbon, is an advanced persistent threat (APT) tool used primarily in cyber-espionage operations. It is known for targeting government and financial sectors, particularly in Eastern Europe.
Reports & references
- CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
- circl.lu — Tr 25 (report)
- Kaspersky — The Epic Turla Operation (report)
- ESET — Carbon Paper Peering Turlas Second Stage Backdoor (report)
- Broadcom/Symantec — Waterbug Attack Group (report)
- secureworks.com — Iron Hunter (report)
- Kaspersky — 88069 (report)
- CISA — Aa23 129A (report)
- Broadcom/Symantec — Waterbug Attack Group 16 En (report)
- youtube.com — Watch (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Cobra (report)
- govcert.ch — Report Ruag Espionage Case (report)
- accenture.com — Turla Belugasturgeon Compromises Government Entity (report)
- github.com — Turla Carbon (report)
- melani.admin.ch — Report Ruag Espionage Case (report)
- blog.gdatasoftware.com — 23926 Analysis Of Project Cobra (report)
- github.com — Tdl (report)