Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label CosmicBeetle. Show all posts
Turkey
CosmicBeetle Cyber Attacks ESET ESET Research Malware Attack ransomware attacks small business security Small Businesses Turkey

CosmicBeetle Exploits Vulnerabilities in Small Businesses Globally

 

CosmicBeetle is a cybercriminal group exploiting vulnerabilities in software commonly used by small and medium-sized businesses (SMBs) across Turkey, Spain, India, and South Africa. Their main tool, a custom ransomware called ScRansom, is still under development, leading to various issues in the encryption process. This sometimes leaves victims unable to recover their data, making the ransomware not only dangerous but also unpredictable. 

Based on analysis by Slovakian cybersecurity firm ESET, CosmicBeetle’s skills as malware developers are relatively immature. This inexperience has led to chaotic encryption schemes, with one victim’s machines being encrypted multiple times. Such issues complicate the decryption process, making it unreliable for victims to restore their data, even if they comply with ransom demands. Unlike well-established ransomware groups that focus on making the decryption process smoother to encourage payment, CosmicBeetle’s flawed approach undermines its effectiveness, leaving victims in a state of uncertainty. 

Interestingly, the group has attempted to boost its reputation by implying ties to the infamous LockBit group, a well-known and more sophisticated ransomware operation. However, these claims seem to be a tactic to appear more credible to their victims. CosmicBeetle has also joined the RansomHub affiliate program, which allows them to distribute third-party ransomware, likely as an attempt to strengthen their attack strategies. The group primarily targets outdated and unpatched software, especially in SMBs with limited cybersecurity infrastructure. They exploit known vulnerabilities in Veeam Backup & Replication and Microsoft Active Directory. 

While CosmicBeetle doesn’t specifically focus on SMBs, their choice of software vulnerabilities makes smaller organizations, which often lack robust patch management, easy targets. According to ESET, businesses in sectors such as manufacturing, pharmaceuticals, education, healthcare, and legal industries are particularly vulnerable. CosmicBeetle’s attacks are opportunistic, scanning for weak spots in various sectors where companies might not have stringent security measures in place. Turkey, in particular, has seen a high concentration of CosmicBeetle’s attacks, suggesting that the group may be operating from within the region. 

However, organizations in Spain, India, and South Africa have also been affected, illustrating the group’s global reach. CosmicBeetle’s focus on exploiting older vulnerabilities demonstrates the need for businesses to prioritize patching and updating their systems regularly. One key issue with CosmicBeetle’s operations is the immaturity of their ransomware development. Unlike more experienced cybercriminals, CosmicBeetle’s encryption tool is in a constant state of flux, making it unreliable for victims. While ESET has been able to verify that the decryption tool technically works, its rapid and frequent updates leave victims uncertain whether they can fully recover their data. To reduce the risk of falling victim to such attacks, SMBs must prioritize several cybersecurity measures. 

First and foremost, regular software updates and patch management are essential. Vulnerabilities in widely used platforms like Veeam Backup and Microsoft Active Directory must be addressed promptly. Businesses should also invest in employee cybersecurity training, emphasizing the importance of recognizing phishing attacks and suspicious links. In addition to these basic cybersecurity practices, companies should back up their data regularly and have robust incident response plans. Having a reliable backup strategy can mitigate the damage in the event of a ransomware attack, ensuring that data can be restored without paying the ransom. Companies should also invest in cybersecurity solutions that monitor for unusual network activity, providing early warning signs of potential breaches.
Read more »
ScHackTool
CosmicBeetle cryptocurrency Cyberattacks CyberCrime Cybersecurity ESET malware Remote Desktop Protocol Scarab Ransomware ScHackTool

Scarab Ransomware Toolkit: Unveiling the Ingenious Weaponry

 


In a recent report, cybersecurity researchers from the ESET cybersecurity company highlighted that malware of the Scarab ransomware family has been deployed to spread its variants across global victim organizations using a malicious toolset named Spacecolon. 

ESET has issued an advisory about the vulnerability of the toolset that may allow targeted attackers to penetrate victim organizations by exploiting commonly vulnerable web servers or using brute-force attacks against Remote Desktop Protocol (RDP) credentials to gain entry into victim organizations. As a result of ESET's investigation, it was also discovered that certain Spacecolon versions include Turkish strings, which suggests that a Turkish-speaking developer was involved in the development of these versions.  

According to a detailed technical report released on August 22, 2023, by ESET security researcher Jakub Souek, the Spacecolon malicious toolkit is being used by a cyber campaign that is targeting organizations all over the world to spread various variants of the Scarab ransomware, and it is targeting anti-torture organizations in particular. 

As of May 20, 2023, the most recent build of Spacecolon has been carried out, and the roots of the project can be traced back to as early as May 2020. Despite extensive tracking and analysis, ESET does not yet have an explanation as to what threat actor group is likely to be using the toolset to exploit the system. This has led to the name "CosmicBeetle" being used by the firm for the operators behind Spacecolon due to the similarity of their names. 

The threat actor CosmicBeetle is reported to have infiltrated some companies through misconfigured web servers, and they attempt to brute-force login information for Remote Desktop Protocol (RDP) by accessing misconfigured web servers. There have been victims across several countries who have been identified as having been infected by the Spacecolon virus since May 2020. This includes France, Mexico, Poland, Slovakia, Spain, and Turkey.

An American school in Mexico was attacked by a group of hackers, who chose a hospital and tourist resort in Thailand as their targets, an insurance company in Israel, a Polish government organization, an entertainment company in Brazil, and a Turkish environmental company based in Turkey. Further, Cosmic Beetle may also target unpatched servers that have not yet been updated with security patches, attempting to infiltrate networks by exploiting these vulnerabilities. 

The CosmicBeetle botnet deploys the main Spacecolon component used by CosmicBeetle to compromise vulnerable web servers after CosmicBeetle compromises the target web server. It is called ScHackTool. This type of attack relies heavily on the operating system's GUI and the active participation of operators; the GUI enables operators to orchestrate attacks and download and execute additional tools on demand, according to their requirements, on compromised machines. 

A CosmicBeetle can deploy ScInstaller over the local network and use it to further secure the target. For example, it can use ScInstaller to install ScService, which provides even further remote access to the target. Ultimately, CosmicBeetle deploys the Scarab ransomware variant as its final payload as a part of its campaign. 

A clipboard monitoring software known as ClipBanker is deployed in this variant, which monitors the contents of the clipboard and changes any suspicious contents, e.g. cryptocurrency wallet addresses, into a controlled address that is controlled by the attacker. Additionally, samples of a new ransomware family are being uploaded to VirusTotal from Turkey, suggesting that this family is being developed. 

As a result of the research conducted by ESET, the company is convinced that this malware has been written by the same developers that wrote Spacecolon, a virus that has been named ScRansom by ESET. In addition to it encrypting all hard drives, removable drives, and remote drives, ScRansom also encrypts e-mail. 

The ransomware has not yet been seen in the wild, and the development stage of this ransomware is still at a pre-release stage. First discovered in February 2023, it is most likely that the attacks have changed intact as a result of the discovery of Spacecolon variants released by Zaufana Trzecia Strona. 

Spacecolon is primarily composed of ScHackTool, an orchestrator based on Delphi that deploys an installer that, just as the name implies, installs ScService, a backdoor that can run customized commands, download and execute payloads, and extract information from compromised systems to obtain system information. It is also responsible for incorporating several third-party tools that are retrieved from a remote server, IP address 193.149.185.23, which can be accessed using ScHackTool. They are aimed at exploiting the access provided by ScService to introduce a ransomware variant called Scarab that has the goal of obtaining ransom money from the user. 

The threat actors using Impacket to deliver ScService in place of ScHackTool is also another alternative infection chain identified by ESET, indicating that the threats are experimenting with different techniques to deploy ScService instead of ScHackTool. 

The motives of CosmicBeetle have been financial, as the ransomware payload includes clipper malware that monitors the system clipboard and replaces cryptocurrency wallet addresses with ones the attacker controls through the use of file-sharing programs. 

There is also evidence that suggests that there may be active development of another strain of ransomware known as ScRansom that is actively being developed. AES-128 can be used to encrypt hard drives, removable drives, and networked drives; the encryption key can be derived from a hard-coded string, making the variant suitable for cases when the encryption key must be derived from multiple sources. 

A second issue with CosmicBeetle's malware is the lack of effort to conceal its presence, as well as the fact that their toolset leaves several artifacts behind when compromised machines are compromised, as well as a lack of robust anti-analysis and anti-emulation defenses.
Read more »
Subscribe to: Posts (Atom)