EmpireMonkey, CobaltGoblin
EmpireMonkey, CobaltGoblin is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets the Finance sector in Malta.
- EmpireMonkey
- CobaltGoblin
- Anthropoid Spider
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2018
- Record updated
Who They Target.
About EmpireMonkey, CobaltGoblin.
EmpireMonkey is an advanced financially motivated cybercriminal gang. The group gained notoriety for a heist they conducted in February 2019 against the Maltese Bank of Valletta, which initially resulted in roughly €13 million in losses, though much of this was subsequently recovered or frozen. While a thorough post-mortem of the Bank of Valletta attack has yet to be made public, it is highly likely that the threat actors sent malicious spear phishing emails to employees at Bank of Valletta and other European financial institutions. In October 2018, HSBC Malta reported receiving phishing emails that bore hallmarks of the subsequent EmpireMonkey attack against Bank of Valletta. This group seems to be directly related to {{Carbanak, Anunak}} and/or {{FIN7}}.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.