Everyone’s gotta get started somewhere—and the same goes for making one’s bones as a small-time ransomware gang.

New research from European cybersecurity firm ESET sheds light on CosmicBeetle, a threat actor targeting small and midsize businesses (SMBs) with custom ransomware.

CosmicBeetle has been active since 2020, according to ESET researchers, but since 2023 has targeted European and Asian SMBs with their ScRansom malware. The report described CosmicBeetle as “an immature actor in the ransomware world,” and ScRansom as “not very sophisticated,” but warned it compensates for flaws in its approach by impersonating more intimidating gangs like LockBit.

ESET Head of Public Relations Jessica Beffa told IT Brew via email that CosmicBeetle used to deploy an easily detected, static ransomware variant named Scarab. Now it’s in “complete control of ScRansom and its source code,” Beffa wrote.

“With ScRansom, we see CosmicBeetle continually modify even the core of the ransomware, including changing [the] encryption scheme,” Beffa added. “It does not make ScRansom more dangerous directly, though it definitely gives CosmicBeetle more options.”

Read the rest here.—TM

Survey of the mainframe—survey IT brain!

No, it’s not a Cypress Hill reunion, but that doesn’t mean there’s not some smoke in BMC Software’s new State of the Mainframe. The survey’s findings revealed an overall positive view of the platform, from its hardware capabilities—like IBM’s new Telum II processor—to the potential of AI.

John McKenny, BMC SVP and general manager of intelligent Z optimization and transformation, told IT Brew that the mainframe is “thriving.”

“The long-term outlook for the platform is very strong,” McKenny said. “Ninety-four percent of the respondents said the platform…runs [their] core business applications and services. It’s part of [their] hybrid infrastructure.”

Cock the hammer. BMC polled more than 1,000 professionals from around the world, finding that mainframe investment is stabilizing. The survey also found that organizations are considering more cloud technology to supplement mainframe infrastructure, primarily because of flexibility, usage of data and analytics, and cost savings. It’s part of an overall strategy, McKenny told IT Brew.

Read more here.—EH

Like snowflakes, agents, and K in the cereal aisle, every malware is special—lately at least.

Software company BlackBerry, in its quarterly report of cyberattacks from April to June 2024, noticed an average of 11,500 unique malware samples per day, a 53% jump and “one of the highest percentage increases, quarter over quarter,” since the software company began its Global Threat Intelligence reports in January 2023.

You might expect AI to be behind such massive production, but BlackBerry’s lead researcher says the steep increase demonstrates that the ransomware-as-a-service (RaaS) market—and a core piece of it known as the ransomware builder—is alive and well.

“Having been in the industry for 24 years, I’ve never seen so much availability of these builders and so much knowledge on how to create malware,” Ismael Valenzuela, VP of threat research and intelligence at BlackBerry, told IT Brew.

Keep reading here.—BH

Join us for a cybersecurity event in New York on Oct. 31, where industry leaders Akiba Saeedi, VP of Product Management at IBM Security, and George Barnes, Cyber Practice President at Red Cell, will dive into the future of cyber defense. Can’t make it in person? Grab a livestream pass and be part of the conversation from anywhere!