Noname

NoName, also known as CosmicBeetle, is a pro-Russia threat actor group that has been active since at least 2020. The group is notorious for exploiting years-old vulnerabilities in systems, particularly those of small and medium-sized businesses, which have often left these flaws unpatched. They have a history of using these vulnerabilities to launch attacks globally, including the exploitation of a flaw in Veeam Backup (CVE-2023-27532) and a 2022 flaw in FortiOS SSL-VPN (CVE-2022-42475). NoName's operations are marked by their use of custom ransomware, cryptor malware tracked as ScRansom, and their initial attempts to infect systems, as seen in a June hacking incident at an unnamed Indian manufacturing company. In September 2023, NoName escalated their activities by setting up a dedicated leak site (DLS) on Tor, dubbed NONAME. This move was mirrored when they registered the domain lockbitblog[.]info, adopting a similar approach but incorporating the LockBit logo. Researchers discovered that NoName had been experimenting with LockBit's leaked builder, even creating a counterfeit leak site that mimicked LockBit's platform. This fake site hosted ransom notes and attempted to convince victims that they had been targeted by the infamous LockBit group. The group gained significant attention following a DDoS attack on Canadian airports, causing severe disruptions. This event highlighted NoName's capacity to cause substantial real-world harm. More recently, researchers from Eset have suggested with medium confidence that NoName has allied with RansomHub, further expanding their potential threat landscape. As such, NoName represents a considerable ongoing cybersecurity risk, particularly for organizations with unpatched system vulnerabilities.