CosmicBeetle

CosmicBeetle is a threat actor known for deploying the ScRansom ransomware, which has replaced its previous variant, Scarab. The actor utilizes a custom toolset called Spacecolon, consisting of ScHackTool, ScInstaller, and ScService, to gain initial access through RDP brute forcing and exploiting vulnerabilities like CVE-2020-1472 and FortiOS SSL-VPN. CosmicBeetle has been observed impersonating the LockBit ransomware gang to leverage its reputation and has shown a tendency to leave artifacts on compromised systems. The group primarily targets SMBs globally, employing techniques such as credential dumping and data destruction.

Qrup 1 zərərli proqram ailəsi ilə əlaqələndirilib.

Qrup 1 zərərli proqram ailəsi ilə əlaqələndirilib.

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://www.welivesecurity.com/en/eset-research/cosmicbeetle-steps-up-probation-period-ransomhub/

Mənbə: MISP Galaxy, Malpedia.