Cosmicbeetle

CosmicBeetle, also known as NoName, is a threat actor that has been active since 2020. ESET researchers have recently published an in-depth analysis of this cybercrime group's activities. Despite the crude and clumsy nature of its operations, CosmicBeetle has managed to compromise various targets worldwide, primarily Small and Medium-sized Businesses (SMBs), using its new ScRansom ransomware. Interestingly, the group appears to lack sophisticated skillsets but still achieves "stealth" through odd, impractical, and overcomplicated techniques. The malware used by CosmicBeetle is controlled via a graphical user interface (GUI) and leaves plenty of artifacts on compromised systems, making little effort to hide its presence. The group's financial motives are clear, with their ransomware payload dropping clipper malware to monitor the system clipboard and alter cryptocurrency wallet addresses to those under their control. CosmicBeetle operators use a tool known as ScHackTool to download additional tools onto compromised machines and run them as they deem fit. Notably, the analysis revealed that CosmicBeetle is likely a new affiliate of the ransomware-as-a-service actor RansomHub. In a bid to bolster its reputation, CosmicBeetle has shifted towards impersonating the notorious LockBit gang, a move seen as exploiting the infamy of LockBit for its own ends. This tactic combined with their particular focus on Turkish targets suggests a deeper knowledge and confidence in targeting entities within this region. For more detailed insights into CosmicBeetle’s operations, including their encryption routine, victimology, and interactions with high-profile gangs such as LockBit and RansomHub, follow ESET Research and listen to their podcast episodes.