CosmicBeetle steps up: Probation period at RansomHub

ESET documents CosmicBeetle's ongoing activity deploying ScRansom against SMBs across Europe and Asia, describing its transition from Scarab to ScRansom, use of Delphi-based custom tooling (Spacecolon), experiments with a leaked LockBit builder and impersonation of LockBit, and a possible recent affiliation with RansomHub; the report provides a technical breakdown of ScRansom's partially destructive encryption and fragile decryption process, victimology, IoCs (file hashes, domains, emails, Tox IDs), and mapped MITRE ATT&CK techniques.