CVE/vulnerability

CosmicBeetle Exploiting Old Vulnerabilities To Attacks SMBs All Over The World

CosmicBeetle, a threat actor specializing in ransomware, has recently replaced its old ransomware, Scarab, with ScRansom, a custom-built ransomware that continues to evolve. 

The threat actor has been actively targeting SMBs worldwide, exploiting vulnerabilities to gain access to their systems and experimenting with the leaked LockBit builder, attempting to leverage its reputation by impersonating the notorious ransomware gang. 

It is believed, with medium confidence, that CosmicBeetle is a new affiliate of RansomHub, a rising ransomware-as-a-service group, which is a relatively new ransomware actor, and has been actively targeting SMBs in Europe and Asia with its custom-developed ScRansom. 

While ScRansom is not particularly sophisticated, CosmicBeetle has successfully compromised several interesting targets due to their immature approach and the use of leaked LockBit tools. 

ESET telemetry and code analysis strongly suggest ScRansom is a new tool developed by CosmicBeetle. Code similarities, overlapping deployments, and shared components with other CosmicBeetle tools provide compelling evidence. 

While previous attribution to a Turkish software developer was inaccurate, the encryption scheme used in ScHackTool is likely adapted from an open-source algorithm, which further supports the connection between ScRansom and CosmicBeetle, solidifying the attribution.

NONAME dedicated leak site on Tor

CosmicBeetle, a ransomware group, primarily targets SMBs in various sectors using brute-force attacks and exploits known vulnerabilities such as EternalBlue, CVE-2023-27532, AD privilege escalation vulnerabilities, FortiOS SSL-VPN vulnerability, and Zerologon.

The group’s victims include companies in manufacturing, pharmaceuticals, legal, education, healthcare, technology, hospitality, financial services, and regional government.

CosmicBeetle communicates with its victims through email and qTox, a messaging application, and uses a custom ransomware named NONAME.

Website mimicking the official LockBit leak site, set up by CosmicBeetle

A less-established ransomware group impersonated the well-known LockBit to enhance their credibility by first creating a fake LockBit leak site with similar design and reused compromised victim data from LockBit.

Simulating Cyberattack Scenarios With All-in-One Cybersecurity Platform – Watch Free Webinar

Later, they even built a ransomware sample using the leaked LockBit builder and included a Turkish ransom note with their contact info. Evidence suggests CosmicBeetle might also be a new affiliate of RansomHub, as their tools and behaviors were observed in a recent RansomHub attack.

User interface of ScRansom

ScRansom, a ransomware developed by CosmicBeetle, employs a complex encryption scheme involving AES and RSA keys. It encrypts files on various drives and can also permanently delete files.

The ransomware is initially launched by the threat actor through manual interaction, but newer versions automate the process. Victims must pay a ransom to obtain a decryption key, which is required to recover their encrypted files.

However, the decryption process is complex and may fail due to various factors, including multiple encryption sessions and potential file destruction.

Encryption scheme utilized by the latest ScRansom samples

It has been deploying a new custom ransomware, ScRansom, after abandoning Scarab. Despite attempts to leverage LockBit’s reputation, ScRansom remains complex and prone to errors. 

According to ESET research, the actor’s deployment of RansomHub payloads on the same machine as ScRansom suggests a potential affiliation with RansomHub. 

The ongoing development of ScRansom poses significant risks to victims, as successful decryption is uncertain and may require extensive manual effort.

Simulating Cyberattack Scenarios With All-in-One Cybersecurity Platform – Watch Free Webinar

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

TorNet Backdoor Exploits Windows Scheduled Tasks to Deploy Malware

Cisco Talos researchers have identified an ongoing cyber campaign, active since mid-2024, deploying a previously…

6 hours ago

Hackers Could Bypassing EDR Using Windows Symbolic Links to Disable Service Executables

A groundbreaking technique for exploiting Windows systems has emerged, combining the "Bring Your Own Vulnerable…

6 hours ago

Microsoft Unveils Phishing Attack Protection for Teams Chat

Microsoft has taken a significant step toward enhancing cybersecurity by introducing a new phishing attack…

12 hours ago

Apple Security Update – Patch for iOS Zero-day, MacOS & More

Apple has responded to a newly discovered zero-day vulnerability affecting its operating systems by releasing…

13 hours ago

Stratoshark – A New Wireshark Tool Released for Cloud

The masterminds behind the revolutionary network analyzer Wireshark have unveiled a new tool, Stratoshark, designed…

14 hours ago

Hackers Mimic USPS To Deliver Malicious PDF In Attack Targeted Mobile Devices

In a detailed analysis published on January 27, 2025, Zimperium's zLabs team uncovered a sophisticated…

14 hours ago