Sunday, March 30, 2025
Homepasswordless authenticationCuba Ransomware Armed with New Weapons to Attack U.S Infrastructure

Cuba Ransomware Armed with New Weapons to Attack U.S Infrastructure

Published on

SIEM as a Service

Follow Us on Google News

The Cuba ransomware seems to be gaining more pace with each passing year, and this ransomware has been operating and active since 2019.

Until now, the operators of the Cuba ransomware have executed several high-profile attacks to target many industries and sectors. Besides this, it has already completed various prominent cross-industry episodes throughout early 2023.

Cybersecurity analysts at the BlackBerry Threat Research team recently analyzed a June campaign in which they revealed that this ransomware group attacked critical US infrastructure and a Latin American IT integrator.

In a report shared with Cyber Security News, researchers attributed the Cuba ransomware group to being of Russian origin and actively targeting the infrastructure sector. 

It’s even been claimed that they have added a new set of tools to their arsenal along with CVE-2023-27532, the Veeam vulnerability.

Technical Analysis

Cuba ransomware (aka COLDDRAW, Fidel) strategically targeted a moderate victim pool, marking encrypted files for the ransomware’s and its decryptor’s identification.

Cuba ransomware leak site (Source – BlackBerry)

Cuba ransomware makes use of a double-extortion approach for ransom from its victims, and it’s been revealed by U.S. law enforcement that till now it has compromised 101 entities from:

  • 65 in the United States
  • 36 outside the United

Within these 4 years, the operators of this ransomware group demanded $145 million in ransom from its victims and managed to accumulate $60 million.

Here below, we have mentioned all the inclusions of Core Tactics:

  • LOLBins
  • Exploits
  • Both off-the-shelf
  • Custom malware
  • Cobalt Strike
  • Metasploit

The initial breach showed that the Administrator-level RDP login failed without failed attempts, hinting at prior credential theft. 

Cuba’s toolkit, a mix of custom and off-the-shelf elements, presents similarities with past campaigns and their known tactics.

Tools, Exploits, and Tactics Used

Here below, we have mentioned all the tools, exploits, and tactics that the operators behind the Cuba ransomware group use:-

  • BUGHATCH
  • Metasploit DNS Stager
  • Wedgecut
  • Defense Evasion
  • BURNTCIGAR
  • CVE-2020-1472 — NetLogon
  • CVE-2023-27532 — Veeam
  • Cobalt Strike Beacon
  • Lateral movement
  • nltest utility
  • PSexec
  • Network management utility – net.exe
  • LOLBins
  • netpingall.exe
Main execution chain (source: BlackBerry)

Additionally, the strategy the Cuba ransomware group’s operators use suggests that the group has financial motivations.

Recommendations

Below, we have listed all the recommendations offered by the security researchers:

  • Keep network systems and system programs up-to-date with the latest patches and updates.
  • Deploy a proper patch management program for the quick prompt.
  • Make sure to implement a robust email gateway solution.
  • Ensure adequate segmentation for networks.
  • Use a robust data backup solution for up-to-date, comprehensive data backup.
  • Always use a robust endpoint protection platform, AV tools, and other necessary modern firewall solutions.
  • Use Multi-Factor Authentication (2FA) solutions wherever possible.
  • Ensure the use of VPNs.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Gamaredon Hackers Weaponize LNK Files to Deliver Remcos Backdoor

Cisco Talos has uncovered an ongoing cyber campaign by the Gamaredon threat actor group,...

“Crocodilus” A New Malware Targeting Android Devices for Full Takeover

Researchers have uncovered a dangerous new mobile banking Trojan dubbed Crocodilus actively targeting financial...

SquareX Discloses Browser-Native Ransomware that Puts Millions at Risk

From WannaCry to the MGM Resorts Hack, ransomware remains one of the most damaging...

Hackers Exploit DNS MX Records to Create Fake Logins Imitating 100+ Brands

Cybersecurity researchers have discovered a sophisticated phishing-as-a-service (PhaaS) platform, dubbed "Morphing Meerkat," that leverages...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Kuala Lumpur Airport Hit by Cyberattack, Hackers Demand $10M Ransom

Kuala Lumpur International Airport (KLIA), one of Southeast Asia's busiest airports, was hit by...

Blacklock Ransomware Infrastructure Breached, Revealing Planned Attacks

Resecurity, a prominent cybersecurity firm, has successfully exploited a vulnerability in the Data Leak...

Classiscam Operators Use Automated Malicious Sites to Steal Financial Data

Classiscam, an automated scam-as-a-service operation, has been identified as a significant threat in Central...