CosmicBeetle Exploiting Old Vulnerabilities To Attacks SMBs All Over The World

CosmicBeetle, a threat actor specializing in ransomware, has recently replaced its old ransomware, Scarab, with ScRansom, a custom-built ransomware that continues to evolve. 

The threat actor has been actively targeting SMBs worldwide, exploiting vulnerabilities to gain access to their systems and experimenting with the leaked LockBit builder, attempting to leverage its reputation by impersonating the notorious ransomware gang. 

It is believed, with medium confidence, that CosmicBeetle is a new affiliate of RansomHub, a rising ransomware-as-a-service group, which is a relatively new ransomware actor, and has been actively targeting SMBs in Europe and Asia with its custom-developed ScRansom. 

While ScRansom is not particularly sophisticated, CosmicBeetle has successfully compromised several interesting targets due to their immature approach and the use of leaked LockBit tools. 

ESET telemetry and code analysis strongly suggest ScRansom is a new tool developed by CosmicBeetle. Code similarities, overlapping deployments, and shared components with other CosmicBeetle tools provide compelling evidence. 

While previous attribution to a Turkish software developer was inaccurate, the encryption scheme used in ScHackTool is likely adapted from an open-source algorithm, which further supports the connection between ScRansom and CosmicBeetle, solidifying the attribution.

CosmicBeetle, a ransomware group, primarily targets SMBs in various sectors using brute-force attacks and exploits known vulnerabilities such as EternalBlue, CVE-2023-27532, AD privilege escalation vulnerabilities, FortiOS SSL-VPN vulnerability, and Zerologon.

The group’s victims include companies in manufacturing, pharmaceuticals, legal, education, healthcare, technology, hospitality, financial services, and regional government.

CosmicBeetle communicates with its victims through email and qTox, a messaging application, and uses a custom ransomware named NONAME.

A less-established ransomware group impersonated the well-known LockBit to enhance their credibility by first creating a fake LockBit leak site with similar design and reused compromised victim data from LockBit.

Simulating Cyberattack Scenarios With All-in-One Cybersecurity Platform – Watch Free Webinar

Later, they even built a ransomware sample using the leaked LockBit builder and included a Turkish ransom note with their contact info. Evidence suggests CosmicBeetle might also be a new affiliate of RansomHub, as their tools and behaviors were observed in a recent RansomHub attack.

ScRansom, a ransomware developed by CosmicBeetle, employs a complex encryption scheme involving AES and RSA keys. It encrypts files on various drives and can also permanently delete files.

The ransomware is initially launched by the threat actor through manual interaction, but newer versions automate the process. Victims must pay a ransom to obtain a decryption key, which is required to recover their encrypted files.

However, the decryption process is complex and may fail due to various factors, including multiple encryption sessions and potential file destruction.

It has been deploying a new custom ransomware, ScRansom, after abandoning Scarab. Despite attempts to leverage LockBit’s reputation, ScRansom remains complex and prone to errors. 

According to ESET research, the actor’s deployment of RansomHub payloads on the same machine as ScRansom suggests a potential affiliation with RansomHub. 

The ongoing development of ScRansom poses significant risks to victims, as successful decryption is uncertain and may require extensive manual effort.

Simulating Cyberattack Scenarios With All-in-One Cybersecurity Platform – Watch Free Webinar