ScRansom Ransomware Attacks Small & Medium Businesses

ScRansom Ransomware is one of the most dangerous infections. It is a custom-built ransomware strain developed by a threat actor known as CosmicBeetle. ScRansom Ransomware is causing havoc for small and medium-sized businesses (SMBs) across Europe, Asia, Africa, and South America.

ScRansom has emerged as a sophisticated weapon in cybercriminals' hands, seeking to exploit weaknesses in a broad range of industries. As it continues to spread, ScRansom Ransomware raises significant concerns for the cybersecurity landscape. Here's a closer look at what ScRansom is, how it operates, and what it aims to achieve.

Understanding ScRansom Ransomware

ScRansom is a relatively new strain of ransomware, which has replaced an earlier variant called Scarab, previously deployed by CosmicBeetle. This new strain has infiltrated and targeted businesses in diverse sectors, including manufacturing, healthcare, pharmaceuticals, technology, and even regional governments. CosmicBeetle, also known by the alias NONAME, has established itself as a notable player in the cybercrime world, particularly through its Spacecolon toolset to deliver malicious payloads.

While not the most sophisticated ransomware in the market, ScRansom is continually being updated and refined. According to cybersecurity researchers, CosmicBeetle has been improving the ransomware's effectiveness, particularly by adopting tools from other ransomware groups and enhancing its attack vectors. Despite its developmental status, ScRansom has compromised interesting and valuable targets.

What Ransomware Programs Do

Ransomware programs like ScRansom are designed to infect systems, encrypt files, and demand ransom payments from victims in exchange for decryption keys. They are often deployed through phishing attacks, brute-force password cracking, or exploiting known system vulnerabilities. Once the ransomware is inside a network, it spreads quickly, encrypting essential data and files, leaving businesses unable to operate effectively.

The goal of these programs is simple: extort money from their victims. In the case of ScRansom, after encrypting files, the attackers demand a ransom to restore access. If victims refuse to pay, they often face the risk of permanent data loss, as ScRansom has an "ERASE" mode that renders files unrecoverable by overwriting them with random data. This makes it extremely difficult for victims to recover their data without the encryption key, which is only accessible after ransom pay.

What ScRansom Wants

The primary objective of ScRansom, like most ransomware strains, is financial gain. CosmicBeetle aims to capitalize on vulnerable systems by demanding ransoms in exchange for decryption keys. However, ScRansom's creators have gone a step further by attempting to leverage the reputation of other high-profile ransomware groups to pressure victims into paying.

One notable tactic involves CosmicBeetle's tools and techniques borrowed from more infamous ransomware groups like LockBit. In some cases, they have tried to make their attacks appear as though these more established groups carried them out. By doing this, they seek to increase the likelihood that victims will pay the ransom quickly, fearing that they are dealing with more dangerous and well-known attackers.

Another notable aspect of ScRansom's strategy is its possible connection to RansomHub, another ransomware group. Evidence indicates that ScRansom and RansomHub payloads were deployed on the same target systems within a short time frame, suggesting some level of collaboration or shared techniques between the two groups.

How ScRansom Infiltrates Systems

CosmicBeetle leverages a variety of attack methods to deliver ScRansom, including brute-force attacks and the exploitation of known vulnerabilities. These vulnerabilities, many of which have been publicly disclosed and patched, are still actively used by cybercriminals to infiltrate systems that have not been adequately secured. Among the most commonly exploited vulnerabilities by ScRansom are CVE-2017-0144, CVE-2020-1472, CVE-2021-42278, CVE-2021-42287, CVE-2022-42475, and CVE-2023-27532.

Once inside a system, the ransomware uses several tools, such as Reaper, Darkside, and RealBlindingEDR, to disable security measures and avoid detection. ScRansom's ability to terminate security processes makes it especially dangerous, as it can bypass many of the defenses organizations have to protect their systems.

ScRansom’s Increasing Threat

The rise of ScRansom highlights the ongoing evolution of ransomware as a tool for cyber extortion. With attackers continuously developing new strains and improving existing ones, businesses of all sizes need to remain vigilant. SMBs, in particular, have become a primary target due to their often limited cybersecurity resources and defenses.

CosmicBeetle's frequent updates to ScRansom demonstrate their commitment to improving the ransomware's effectiveness. The group has even experimented with using tools like LockBit's builder to enhance their capabilities, hoping to emulate the success of larger, more notorious ransomware operations. This constant refinement suggests that ScRansom could become an even more formidable threat in the near future.

Protecting Against ScRansom and Other Ransomware

To protect against ransomware like ScRansom, businesses must take proactive steps to secure their networks. Regularly patching known vulnerabilities, implementing strong password policies, and ensuring employees know phishing risks are critical. Additionally, advanced security solutions such as Endpoint Detection and Response (EDR) tools can help detect and block ransomware before it can cause significant damage.

As ransomware evolves, businesses must adapt and strengthen their cybersecurity defenses to avoid these increasingly sophisticated threats. While ScRansom may not yet be the most advanced ransomware strain, its growth potential and CosmicBeetle's persistence should not be underestimated.