Tuesday, April 29, 2025
Homepasswordless authenticationCuba Ransomware Armed with New Weapons to Attack U.S Infrastructure

Cuba Ransomware Armed with New Weapons to Attack U.S Infrastructure

Published on

SIEM as a Service

Follow Us on Google News

The Cuba ransomware seems to be gaining more pace with each passing year, and this ransomware has been operating and active since 2019.

Until now, the operators of the Cuba ransomware have executed several high-profile attacks to target many industries and sectors. Besides this, it has already completed various prominent cross-industry episodes throughout early 2023.

Cybersecurity analysts at the BlackBerry Threat Research team recently analyzed a June campaign in which they revealed that this ransomware group attacked critical US infrastructure and a Latin American IT integrator.

- Advertisement - Google News

In a report shared with Cyber Security News, researchers attributed the Cuba ransomware group to being of Russian origin and actively targeting the infrastructure sector. 

It’s even been claimed that they have added a new set of tools to their arsenal along with CVE-2023-27532, the Veeam vulnerability.

Technical Analysis

Cuba ransomware (aka COLDDRAW, Fidel) strategically targeted a moderate victim pool, marking encrypted files for the ransomware’s and its decryptor’s identification.

Cuba ransomware leak site (Source – BlackBerry)

Cuba ransomware makes use of a double-extortion approach for ransom from its victims, and it’s been revealed by U.S. law enforcement that till now it has compromised 101 entities from:

  • 65 in the United States
  • 36 outside the United

Within these 4 years, the operators of this ransomware group demanded $145 million in ransom from its victims and managed to accumulate $60 million.

Here below, we have mentioned all the inclusions of Core Tactics:

  • LOLBins
  • Exploits
  • Both off-the-shelf
  • Custom malware
  • Cobalt Strike
  • Metasploit

The initial breach showed that the Administrator-level RDP login failed without failed attempts, hinting at prior credential theft. 

Cuba’s toolkit, a mix of custom and off-the-shelf elements, presents similarities with past campaigns and their known tactics.

Tools, Exploits, and Tactics Used

Here below, we have mentioned all the tools, exploits, and tactics that the operators behind the Cuba ransomware group use:-

  • BUGHATCH
  • Metasploit DNS Stager
  • Wedgecut
  • Defense Evasion
  • BURNTCIGAR
  • CVE-2020-1472 — NetLogon
  • CVE-2023-27532 — Veeam
  • Cobalt Strike Beacon
  • Lateral movement
  • nltest utility
  • PSexec
  • Network management utility – net.exe
  • LOLBins
  • netpingall.exe
Main execution chain (source: BlackBerry)

Additionally, the strategy the Cuba ransomware group’s operators use suggests that the group has financial motivations.

Recommendations

Below, we have listed all the recommendations offered by the security researchers:

  • Keep network systems and system programs up-to-date with the latest patches and updates.
  • Deploy a proper patch management program for the quick prompt.
  • Make sure to implement a robust email gateway solution.
  • Ensure adequate segmentation for networks.
  • Use a robust data backup solution for up-to-date, comprehensive data backup.
  • Always use a robust endpoint protection platform, AV tools, and other necessary modern firewall solutions.
  • Use Multi-Factor Authentication (2FA) solutions wherever possible.
  • Ensure the use of VPNs.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Blinded from Above: How Relentless Cyber-Attacks Are Knocking Satellites Out of Sight

According to the Center for Strategic & International Studies' (CSIS) 2025 Space Threat Assessment,...

Google Chrome Vulnerability Allows Attackers to Bypass Sandbox Restrictions – Technical Details Revealed

A severe vulnerability, identified as CVE-2025-2783, has been discovered in Google Chrome, specifically targeting...

Threat Actors Accelerate Transition from Reconnaissance to Compromise – New Report Finds

Cybercriminals are leveraging automation across the entire attack chain, drastically reducing the time from...

ResolverRAT Targets Healthcare and Pharmaceutical Sectors Through Sophisticated Phishing Attacks

A previously undocumented remote access trojan (RAT) named ResolverRAT has surfaced, specifically targeting healthcare...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

RansomHub Ransomware Deploys Malware to Breach Corporate Networks

The eSentire’s Threat Response Unit (TRU) in early March 2025, a sophisticated cyberattack leveraging...

Fog Ransomware Reveals Active Directory Exploitation Tools and Scripts

Cybersecurity researchers from The DFIR Report’s Threat Intel Group uncovered an open directory hosted...

DragonForce and Anubis Ransomware Gangs Launch New Affiliate Programs

Secureworks Counter Threat Unit (CTU) researchers have uncovered innovative strategies deployed by the DragonForce...