Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · CosmicBeetle · Unknown · misp-galaxy · refreshed 2026-10-06

CosmicBeetle

sigil · no ATT&CK coverage stated

Analyst brief

misp-galaxy

CosmicBeetle is a threat actor known for deploying the ScRansom ransomware, which has replaced its previous variant, Scarab. The actor utilizes a custom toolset called Spacecolon, consisting of ScHackTool, ScInstaller, and ScService, to gain initial access through RDP brute forcing and exploiting vulnerabilities like CVE-2020-1472 and FortiOS SSL-VPN. CosmicBeetle has been observed impersonating the LockBit ransomware gang to leverage its reputation and has shown a tendency to leave artifacts on compromised systems. The group primarily targets SMBs globally, employing techniques such as credential dumping and data destruction.

CVEs CosmicBeetle is cited as exploiting

none on KEV
  1. CVE-2020-14722026-10-17
    1. “CVE-2020-1472 (aka Zerologon).”

      cited as exploiting · named nearby · source: welivesecurity.com ↗ · 2026-10-17

  2. CVE-2022-424752026-10-17
    1. “CVE-2022-42475 (a vulnerability in FortiOS SSL-VPN), and”

      cited as exploiting · named nearby · source: welivesecurity.com ↗ · 2026-10-17

  3. CVE-2021-422782026-10-17
    1. “CVE-2021-42278 and CVE-2021-42287 (AD privilege escalation vulnerabilities) through noPac ,”

      cited as exploiting · named nearby · source: welivesecurity.com ↗ · 2026-10-17

  4. CVE-2021-422872026-10-17
    1. “CVE-2021-42278 and CVE-2021-42287 (AD privilege escalation vulnerabilities) through noPac ,”

      cited as exploiting · named nearby · source: welivesecurity.com ↗ · 2026-10-17

  5. CVE-2023-275322026-10-17
    1. “CVE-2023-27532 (a vulnerability in a Veeam Backup & Replication component),”

      cited as exploiting · named nearby · source: welivesecurity.com ↗ · 2026-10-17

  6. CVE-2017-01442026-10-17
    1. “CosmicBeetle often uses brute-force methods to breach its targets. Besides that, the following vulnerabilities are being exploited by the threat actor: CVE-2017-0144 (aka EternalBlue),”

      cited as exploiting · source: welivesecurity.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

1 source
  1. 1.welivesecurity.com/en/eset-research/cosmicbeetle-steps-up-probation-perio…

Track CosmicBeetle on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.