tlp:white,osint:source-type="blog-post",misp-galaxy:threat-actor="Cobalt",misp-galaxy:mitre-enterprise-attack-relationship="Cobalt Strike uses PowerShell",misp-galaxy:exploit-kit="ThreadKit",misp-galaxy:mitre-enterprise-attack-attack-pattern="Spearphishing Attachment - T1193",misp-galaxy:mitre-enterprise-attack-attack-pattern="Scripting - T1064",misp-galaxy:mitre-enterprise-attack-attack-pattern="CMSTP - T1191",misp-galaxy:mitre-enterprise-attack-attack-pattern="Regsvr32 - T1117",misp-galaxy:mitre-enterprise-attack-attack-pattern="PowerShell - T1086",cert-ist:threat_targeted_system="Windows",cert-ist:threat_targeted_sector="Finance",cert-ist:enriched,cert-ist:ioc_accuracy="high",cert-ist:threat_level="low",cert-ist:threat_type="apt"