Summary:
CosmicBeetle, also known as NoName, is a ransomware-as-a-service (RaaS) operation that has been active since 2020. This group is known for exploiting known vulnerabilities, such as EternalBlue (CVE-2017-0144), and the Zerologon vulnerability (CVE-2020-1472) to infiltrate systems. CosmicBeetle primarily targets small to medium-sized businesses (SMBs) but has also been seen impacting larger organizations across various sectors, including healthcare, finance, and retail.

The ransomware payload used by CosmicBeetle, known as ScRansom, employs AES-256 encryption with a unique RSA key pair per victim, which makes it difficult to recover without paying the ransom. The ransomware is typically distributed through phishing emails or by exploiting exposed RDP (Remote Desktop Protocol) and SMB (Server Message Block) services. The ransomware's dropper often utilizes PowerShell scripts to execute the payload after exploiting vulnerabilities, leveraging fileless malware techniques to evade detection by traditional endpoint security solutions.

Security Officer Comments:
CosmicBeetle has become more sophisticated over time, utilizing both encryption-based attacks and exfiltration of sensitive data, which is then threatened with public release unless the ransom is paid. While the group initially focused on low-value targets, their partnership with the RansomHub RaaS platform has allowed them to scale their operations significantly, offering the ransomware service to other cybercriminals. They also use advanced evasion techniques such as:

• Living off the Land (LoL) techniques: Using native Windows tools like PowerShell, WMIC, and VSSAdmin to move laterally across networks without triggering traditional security alerts.
• Web Shells: After compromising web servers through SQL injection or other web vulnerabilities, they deploy web shells to maintain persistence.
• Ransomware payload delivery: Often delivered via WMI (Windows Management Instrumentation) or malicious Group Policy Objects (GPOs) to ensure wide distribution across the victim network.

MITRE Attack:

• T1071 - Application Layer Protocol
  CosmicBeetle leverages application layer protocols, particularly HTTP/HTTPS, for command-and-control (C2) communications to avoid detection by traditional network monitoring tools.
• T1047 - Windows Management Instrumentation (WMI)
  The group uses WMI to move laterally across the network and execute payloads without triggering alarms, often leveraging the built-in tool to execute malicious commands remotely.
• T1086 - PowerShell
  PowerShell is frequently used to execute malicious scripts and deliver ransomware payloads, often leveraging fileless techniques to bypass endpoint security detection.
• T1075 - Pass the Hash
  In some instances, the group uses stolen hashes to authenticate on remote systems, enabling lateral movement across the network without needing to crack plaintext credentials.
• T1566 - Phishing
  CosmicBeetle frequently deploys phishing emails to distribute the initial payload, utilizing social engineering tactics to trick victims into executing malicious attachments or links.
• T1569 - System Services
  The ransomware often abuses system services to execute malicious code persistently on compromised machines, using legitimate tools like Windows services to evade detection.
• T1110 - Brute Force
  When targeting weak or exposed RDP services, CosmicBeetle employs brute force techniques to guess credentials and gain access to systems within the network.
• T1203 - Exploitation for Client Execution
  The group has been known to exploit vulnerabilities in web applications or browsers to execute malicious payloads. This often occurs through drive-by downloads or social engineering tactics.
• T1021 - Remote Services
  Exposed Remote Desktop Protocol (RDP) and SMB services are leveraged to infiltrate the victim's network. The ransomware also spreads using these services after initial compromise.
• T1490 - Inhibit System Recovery
  CosmicBeetle disables system recovery options like VSS (Volume Shadow Copy) to prevent the victim from recovering encrypted data, further complicating the recovery process after an attack.
• T1486 - Data Encrypted for Impact
  The group employs AES-256 encryption to lock the victim's files, demanding a ransom payment for the decryption key. This is one of the primary techniques used to hold the victim’s data hostage.
• T1070 - Indicator Removal on Host
  The ransomware attempts to delete logs and other indicators of compromise (IOCs) from the affected systems to hinder detection and analysis of the attack.
• T1098 - Account Manipulation
  CosmicBeetle has been seen manipulating user accounts and privileges, often creating new accounts or modifying existing ones to maintain persistence and escalate privileges.
• T1564 - Hide Artifacts
  The group uses various methods to hide artifacts, such as using rootkits or steganography, to avoid detection by security tools and forensic investigators.

Suggested Corrections:
Backup your data, system images, and configurations, regularly test them, and keep the backups offline: Ensure that backups are regularly tested and that they are not connected to the business network, as many ransomware variants try to find and encrypt or delete accessible backups. Maintaining current backups offline is critical because if your network data is encrypted with ransomware, your organization can restore systems.


Update and patch systems promptly: This includes maintaining the security of operating systems, applications, and firmware in a timely manner. Consider using a centralized patch management system; use a risk-based assessment strategy to drive your patch management program.

Test your incident response plan: There's nothing that shows the gaps in plans more than testing them. Run through some core questions and use those to build an incident response plan: Are you able to sustain business operations without access to certain systems? For how long? Would you turn off your manufacturing operations if business systems such as billing were offline?

Check Your Security Team's Work: Use a 3rd party pen tester to test the security of your systems and your ability to defend against a sophisticated attack. Many ransomware criminals are aggressive and sophisticated and will find the equivalent of unlocked doors.

Segment your networks: There's been a recent shift in ransomware attacks – from stealing data to disrupting operations. It's critically important that your corporate business functions and manufacturing/production operations are separated and that you carefully filter and limit internet access to operational networks, identify links between these networks, and develop workarounds or manual controls to ensure ICS networks can be isolated and continue operating if your corporate network is compromised. Regularly test contingency plans such as manual controls so that safety-critical functions can be maintained during a cyber incident.

Train employees: Email remains the most vulnerable attack vector for organizations. Users should be trained on how to avoid and spot phishing emails. Multi-factor authentication can help prevent malicious access to sensitive services.

Link(s):
https://malware.news/t/dark-web-profile-cosmicbeetle-noname-ransomware/88233