CosmicBeetle / ScRansom: The SMB-Focused RaaS Group Quietly Hitting European Businesses

CosmicBeetle operates below the media threshold that Akira, RansomHub, or LockBit routinely cross. Its victims are mostly small and medium-sized businesses across Europe and Asia. Its ransom demands are proportional — typically in the €50,000–€250,000 range rather than the multi-million dollar demands of groups targeting enterprise. That profile keeps it out of headlines. It does not make it less dangerous to the organisations it hits.

ESET researchers first documented CosmicBeetle extensively in 2024 and have tracked its evolution through 2026. The group has run its own ransomware (ScRansom) while also affiliating with RansomHub, giving it flexibility in what payload it deploys against a given target.

Origins and the Spacecolon Toolset

CosmicBeetle’s primary toolset — Spacecolon — predates its ransomware operations. Spacecolon is a collection of Delphi-written tools designed for persistence, remote access, and payload staging. The original Spacecolon components were observed in campaigns deploying Scarab ransomware (an older family) rather than ScRansom, which is why some vendor reporting uses the “Spacecolon” name as a proxy for the threat actor rather than distinguishing it from the malware.

The core Spacecolon components:

• ScHook: A DLL injected into the explorer.exe process to maintain persistence across reboots
• ScInstaller: Drops and installs other Spacecolon components; handles privilege escalation
• ScService: A service-based backdoor for maintaining remote access
• ScPrint: A printer spooler abuse component used for lateral movement in some campaigns

Spacecolon components use the Windows registry for configuration storage, with encrypted configuration blobs stored under HKEY_LOCAL_MACHINE\SOFTWARE subkeys that use randomised names per deployment.

Initial Access: Brute-Force at Scale

CosmicBeetle’s initial access methodology is operationally simple and effective against SMBs with weak credential hygiene. The group predominantly targets:

• RDP (TCP 3389) with password spraying or credential stuffing using leaked credential databases
• Fortinet FortiClient VPN using known CVEs and default credentials — the group was documented exploiting CVE-2023-27997 and has continued to target legacy Fortinet deployments
• Exposed web applications — the group uses automated scanning to identify and exploit known vulnerabilities in internet-facing applications, including ERP and CRM systems common in European SMBs

Credential acquisition is straightforward once initial access is established. Spacecolon components are capable of dumping credentials from LSASS, extracting saved browser credentials, and harvesting RDP saved connection credentials from the Windows Credential Manager.

ScRansom: Technical Profile

ScRansom is written in Delphi and targets Windows environments. It uses a hybrid encryption scheme:

• RSA-4096: Asymmetric key used to encrypt the per-file AES key
• AES-256 CTR: Symmetric encryption applied to file contents
• Partial encryption option: ScRansom supports a configurable partial encryption mode where only a subset of bytes per file are encrypted, trading decryption completeness for encryption speed

The partial encryption feature is a notable operational choice. Full file encryption of large datasets takes time and generates significant disk I/O that endpoint security products may detect through behavioural monitoring. Partial encryption completes faster and produces less distinctive I/O patterns, at the cost of leaving files theoretically recoverable in some cases. ESET documented a decryption complication in 2024 where ScRansom’s partial encryption implementation had a bug, leaving some victims unable to decrypt even after paying — a reputational issue the group appears to have fixed in subsequent versions.

File extension behaviour: Encrypted files receive the .cobelocker extension (recent campaigns; older variants used .scransen). The ransom note is dropped as HOW TO RESTORE YOUR FILES.txt in each encrypted directory.

Shadow copy deletion: ScRansom deletes VSS snapshots via vssadmin delete shadows /all /quiet and disables the Windows Volume Shadow Copy service before beginning encryption.

RansomHub Affiliation

In late 2025, CosmicBeetle began operating as a RansomHub affiliate in parallel with its own ScRansom deployments. This is not unusual in the current RaaS ecosystem — operators with established access brokerage and network footprint affiliate with multiple RaaS platforms to maximise revenue from each intrusion.

The RansomHub affiliation gives CosmicBeetle access to a more mature ransomware binary, a managed data leak site, and negotiation infrastructure. In practice, incident responders have seen CosmicBeetle-attributed intrusions deploy either ScRansom or RansomHub depending on circumstances that are not fully understood — possibly victim size, industry, or operator discretion.

Geographic Targeting

CosmicBeetle’s confirmed victim distribution concentrates in:

• Turkey (the group is assessed with moderate confidence as Turkey-based, though operating internationally)
• Western Europe: Spain, Italy, France, Germany, Austria, and Belgium feature consistently in confirmed victim reports
• South Asia: India and Bangladesh have seen periodic targeting

Sectors represented are broad: manufacturing, professional services (legal, accounting), healthcare, education, and local government. The selection pattern is consistent with opportunistic targeting of organisations with weak perimeter credentials rather than deliberate sector selection.

Detection

Network indicators:

• Brute-force authentication attempts against RDP (Event ID 4625) from external IPs in high volume, followed by a successful login
• RDP connections from geographies inconsistent with the organisation’s normal user base
• vssadmin.exe delete shadows execution (highly suspicious in context)

Host-based Sigma rule (Spacecolon persistence via registry):

title: Spacecolon Registry Persistence
status: experimental
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|startswith: 'HKLM\SOFTWARE\'
    Details|contains: 'ScService'
  condition: selection
falsepositives:
  - None expected
level: high
tags:
  - attack.persistence
  - attack.t1547.001

Ransomware deployment indicators:

• File extension .cobelocker or .scransen appearing on file rename events
• HOW TO RESTORE YOUR FILES.txt created in multiple directories simultaneously
• vssadmin.exe spawned from an unusual parent process (not cmd.exe or typical admin tools)

Current Activity Level

CosmicBeetle maintained consistent activity through H1 2026. ESET and Recorded Future both track the group as operationally active, with estimated victim counts in the 50–80 per quarter range. Victim organisations rarely make public disclosures, which is consistent with the SMB targeting profile. The group does not operate a dedicated leak site for ScRansom victims (though its RansomHub affiliation means some victims appear on the RansomHub leak site).

References

• ESET — CosmicBeetle Ransomware Group Analysis
• ESET — Spacecolon Toolset Technical Deep-Dive
• Recorded Future — RansomHub Affiliate Tracking
• MITRE ATT&CK — G1012 (CosmicBeetle)