ExCobalt is a cybercrime group recognized as an APT group, with members active since at least 2016, linked to the notorious Cobalt Group. Following the arrest of a key Cobalt Group leader in 2018, ExCobalt emerged, fundamentally shifting its primary motivation from financial theft against global financial institutions to cyber espionage and data theft specifically targeting Russian organizations. The group distinguishes itself through the continuous evolution of custom Golang-based tools such as GoRed, its adoption of tools like CobInt from the original Cobalt Group since 2022, and a notable reliance on supply chain compromises involving legitimate software components or stolen contractor credentials to gain initial network access. While drawing personnel and techniques from the broader Eastern European cybercrime circles associated with its predecessor, ExCobalt’s focused shift towards cyber espionage against Russia marks a significant divergence from the earlier group’s purely financ