CosmicBeetle, an emerging ransomware group also known as NONAME, has developed a new ransomware strain called ScRansom, targeting small and medium-sized businesses (SMBs) across Europe, Asia, Africa, and South America. Active since at least 2020, the group is considered relatively immature in the ransomware landscape, even sometimes relying on the reputations of more established threat actors like LockBit to coerce victims into paying ransoms. Despite its lack of sophistication, ScRansom has caused significant damage to various industries, including pharmaceuticals, healthcare, technology, hospitality, and financial services. ScRansom first appeared in March 2023, with researchers noting a continuous development of the ransomware over its lifespan. To gain access to target systems, CosmicBeetle employs brute-force methods and exploits old vulnerabilities in software commonly used by SMBs, which often lack robust patch management processes. The group also uses a variety of tools, such as Reaper, Darkside, and RealBlindingEDR, to terminate security-related processes before deploying ScRansom. CosmicBeetle’s connection to RansomHub, a ransomware gang active since March 2024, has been observed through the deployment of both ScRansom and RansomHub payloads on the same machines within short timeframes. This affiliation is likely an attempt to leverage RansomHub’s more established reputation and tools to compensate for the group’s own technical shortcomings. CosmicBeetle has also been observed experimenting with the leaked LockBit builder, further indicating its reliance on the tools and reputations of more sophisticated ransomware groups. Additionally, the group has utilized various vulnerabilities to infiltrate networks, including CVE-2017-0144 (EternalBlue) and CVE-2020-1472 (ZeroLogon). The ransomware’s encryption scheme is complex, involving multiple key exchanges, which sometimes introduce errors that complicate the decryption process and can result in permanent data loss for victims, even if they pay the ransom. CosmicBeetle has been using RansomHub’s EDR killer tool to disable security agents on compromised devices, further solidifying its affiliation with RansomHub. CosmicBeetle’s emergence and activities highlight an evolving threat. CTIX analysts recommend heightened vigilance, particularly from SMBs in the sectors and geographical areas this threat actor has been known to operate in.