BRATISLAVA — September 30, 2024 — ESET, a global leader in cybersecurity solutions, is proud to announce the launch of its latest global campaign, “Prevention First: Decoding to Protect Business.” This fully integrated marketing and communications campaign aims to educate organizations of any size on enhancing their cybersecurity strategies by incorporating a proactive, prevention-first approach to stay ahead of cyber threats. 

Typically, businesses tend to adopt a reactive approach, focusing on detecting and responding to cyberattacks only after they occur. While detection is crucial, this approach can leave businesses struggling to catch up with increasingly sophisticated threats. The “Prevention First” campaign is designed to change this narrative. It encourages businesses to reduce their attack surface, invest in robust defenses, and adopt a proactive stance toward cybersecurity.

“Prevention is achievable with the right tools,” said Mária Trnková, chief marketing officer at ESET. “We’ve built this campaign to help organizations stop threats before they even enter their networks. Our goal is to provide not just the knowledge, but the actionable insights that businesses need to protect themselves in today’s digital world.”

A key element of the campaign lies in decoding cybersecurity and aims to break down complex prevention concepts into clear, actionable insights. It will help businesses further understand the critical components of a holistic security strategy, from minimizing attack surfaces to reducing complexity, achieving better cyber hygiene, and staying compliant.

The campaign will be rolled out across ESET offices globally over the next year and will feature educational content, visual tools, and a social media extension to help decode the complexities of cybersecurity and implement innovative preventive measures.

For over 30 years, ESET has been dedicated to protecting organizations from evolving digital threats. With advanced security solutions powered by AI, machine learning, human expertise and a prevention-first approach, ESET remains committed to innovation and to delivering comprehensive protection. ESET’s “Prevention First: Decoding to Protect Business” campaign empowers organizations to take a proactive stance, ensuring that they are ready for the challenges of tomorrow’s digital world. By decoding complex cybersecurity topics and providing businesses with the right tools to implement preventive measures, ESET is helping organizations build resilience and stay secure in an increasingly digital world.

To learn more about the Prevention first campaign, visit campaign’s website and follow ESET’s official channels like the ESET Blog, ESET Newsroom, or WeLiveSecurity.com for upcoming events and educational materials.

• ESET Research investigated ScRansom, a novel ransomware developed by the CosmicBeetle threat group. 
• CosmicBeetle has been experimenting with the leaked LockBit builder and trying to mimic LockBit’s brand.
• Furthermore, CosmicBeetle is likely a recent affiliate of the ransomware-as-a-service actor RansomHub, active since March 2024.
• ScRansom is continually improving; however, it is impossible to restore some files.
• CosmicBeetle exploits years-old vulnerabilities to breach SMBs with a focus on Europe and Asia.

BRATISLAVA, PRAGUE — September 10, 2024 — ESET researchers have mapped the recent activities of the CosmicBeetle threat group, documenting its new ScRansom ransomware being deployed and discovering connections to other well-established ransomware gangs. CosmicBeetle has been spreading ransomware to small and medium businesses (SMBs), mainly in Europe and Asia. ESET Research has observed the threat actor using the leaked LockBit builder and trying to leverage LockBit’s ransomware reputation. Besides LockBit, ESET believes that CosmicBeetle is probably a new affiliate of ransomware-as-a-service actor RansomHub, a new ransomware gang active since March 2024 with rapidly increasing activity.

“Probably due to the obstacles that writing custom ransomware from scratch brings, CosmicBeetle attempted to leech off LockBit’s reputation, possibly to mask the issues in the underlying ransomware and in turn to increase the chance that victims would pay,” says ESET researcher Jakub Souček, who analyzed the latest activity of CosmicBeetle. “Additionally, recently, we observed the deployment of ScRansom and RansomHub payloads on the same machine only a week apart. This execution of RansomHub was very unusual compared to the typical cases we have seen in ESET telemetry, but quite similar to CosmicBeetle’s modus operandi. Since there are no public leaks of RansomHub, this leads us to believe with medium confidence that CosmicBeetle may be a recent affiliate of theirs,” adds Souček.

CosmicBeetle often uses brute-force methods to breach its targets. Besides that, it misuses various known vulnerabilities. Small and medium-sized businesses from all sorts of verticals all over the world are the most common victims of this threat actor because that is the segment most likely to use the affected software, or lack robust patch management processes in place. ESET Research has observed attacks on SMBs in the following verticals: manufacturing, pharmaceuticals, legal, education, healthcare, technology, hospitality leisure, financial services, and regional government.

Besides encrypting, ScRansom can also kill various processes and services on the affected machine. ScRansom is not a very sophisticated piece of ransomware, though CosmicBeetle has been able to compromise interesting targets and cause great harm to them. This is mostly because CosmicBeetle is an immature actor in the ransomware world, and problems plague the deployment of ScRansom. Victims affected by ScRansom, who decide to pay, should be cautious.

ESET Research was able to obtain a decryptor implemented by CosmicBeetle for its recent encryption scheme. ScRansom is undergoing constant development, which is never a good sign for ransomware. The overcomplexity of the encryption (and decryption) process is prone to errors, making restoration of all files doubtful. Successful decryption relies on the decryptor working properly and on CosmicBeetle providing all the necessary keys, and even in that case, some files may be destroyed permanently by the threat actor. Even in the best-case scenario, decryption is long and complicated.

CosmicBeetle, active since at least 2020, is the name ESET researchers assigned to a threat actor discovered in 2023. This threat actor is most known for the usage of its custom collection of Delphi tools, commonly called Spacecolon, consisting of ScHackTool, ScInstaller, ScService, and ScPatcher.

For more technical information about the latest activity of CosmicBeetle, check out the blogpost “CosmicBeetle steps up: Probation period at RansomHub” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Heatmap of CosmicBeetle attacks since August 2023, according to ESET telemetry

• South Korea-aligned advanced persistent threat group APT-C-60 weaponized a remote code execution vulnerability in WPS Office for Windows (CVE-2024-7262) in order to target East Asian countries. ESET Research discovered the vulnerability and provides a root cause analysis, along with a description of its weaponization.
• A strange spreadsheet document referencing one of the group’s many downloader components pointed to APT-C-60.
• The exploit is deceptive enough to trick users into clicking on a legitimate-looking spreadsheet while also being very effective and reliable. The choice of the MHTML file format allowed the attackers to turn a code execution vulnerability into a remote one.
• While analyzing the vulnerability, ESET Research discovered another way to exploit it (CVE-2024-7263).
• Following our coordinated vulnerability disclosure policy, as Kingsoft acknowledged and patched both vulnerabilities, we provide a detailed analysis.

BRATISLAVA, MONTREAL — August 28, 2024 — ESET researchers discovered a remote code execution vulnerability in WPS Office for Windows (CVE-2024-7262). It was being exploited by APT-C-60, a South Korea-aligned cyberespionage group, to target East Asian countries. When examining the root cause, ESET discovered another way to exploit the faulty code (CVE-2924-7263). Following a coordinated disclosure process, both vulnerabilities are now patched. The final payload in the APT-C-60 attack is a custom backdoor with cyberespionage capabilities that ESET Research internally named SpyGlace.

“While investigating APT-C-60 activities, we found a strange spreadsheet document referencing one of the group’s many downloader components. The WPS Office software has over 500 million active users worldwide, which makes it a good target to reach a substantial number of individuals, particularly in the East Asia region,” says ESET researcher Romain Dumont, who analyzed the vulnerabilities. During the coordinated vulnerability disclosure process between ESET and the vendor, DBAPPSecurity independently published an analysis of the weaponized vulnerability and confirmed that APT-C-60 has exploited the vulnerability to deliver malware to users in China.

The malicious document comes as an MHTML export of the commonly used XLS spreadsheet format. However, it contains a specially crafted and hidden hyperlink designed to trigger the execution of an arbitrary library if clicked when using the WPS Spreadsheet application. The rather unconventional MHTML file format allows a file to be downloaded as soon as the document is opened; therefore, leveraging this technique while exploiting the vulnerability provides for remote code execution.

“To exploit this vulnerability, an attacker would need to store a malicious library somewhere accessible by the targeted computer either on the system or on a remote share, and know its file path in advance. The exploit developers targeting this vulnerability knew a couple of tricks that helped them achieve this,” explains Dumont. “When opening the spreadsheet document with the WPS Spreadsheet application, the remote library is automatically downloaded and stored on disk,” he adds.

Since this is a one-click vulnerability, the exploit developers embedded a picture of the spreadsheet’s rows and columns inside to deceive and convince the user that the document is a regular spreadsheet. The malicious hyperlink was linked to the image so that clicking on a cell in the picture would trigger the exploit.

“Whether the group developed or bought the exploit for CVE-2024-7262, it definitely required some research into the internals of the application but also knowledge of how the Windows loading process behaves,” concludes Dumont.

After analyzing Kingsoft’s silently released patch, Dumont noticed that it had not properly corrected the flaw and discovered another way to exploit it due to an improper input validation. ESET Research reported both vulnerabilities to Kingsoft, who acknowledged and patched them. Two high severity CVE entries were created: CVE-2024-7262 and CVE-2024-7263.

The discovery underlines the importance of a careful patch verification process and making sure that the core issue has been addressed in full. ESET strongly advises WPS Office for Windows users to update their software to the latest release.

For more technical information about the WPS Office vulnerabilities and exploits, check out the blog post “Analysis of two arbitrary code execution vulnerabilities affecting WPS Office” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.