Monday, February 10, 2025
Homepasswordless authenticationCuba Ransomware Armed with New Weapons to Attack U.S Infrastructure

Cuba Ransomware Armed with New Weapons to Attack U.S Infrastructure

Published on

SIEM as a Service

Follow Us on Google News

The Cuba ransomware seems to be gaining more pace with each passing year, and this ransomware has been operating and active since 2019.

Until now, the operators of the Cuba ransomware have executed several high-profile attacks to target many industries and sectors. Besides this, it has already completed various prominent cross-industry episodes throughout early 2023.

Cybersecurity analysts at the BlackBerry Threat Research team recently analyzed a June campaign in which they revealed that this ransomware group attacked critical US infrastructure and a Latin American IT integrator.

In a report shared with Cyber Security News, researchers attributed the Cuba ransomware group to being of Russian origin and actively targeting the infrastructure sector. 

It’s even been claimed that they have added a new set of tools to their arsenal along with CVE-2023-27532, the Veeam vulnerability.

Technical Analysis

Cuba ransomware (aka COLDDRAW, Fidel) strategically targeted a moderate victim pool, marking encrypted files for the ransomware’s and its decryptor’s identification.

Cuba ransomware leak site (Source – BlackBerry)

Cuba ransomware makes use of a double-extortion approach for ransom from its victims, and it’s been revealed by U.S. law enforcement that till now it has compromised 101 entities from:

  • 65 in the United States
  • 36 outside the United

Within these 4 years, the operators of this ransomware group demanded $145 million in ransom from its victims and managed to accumulate $60 million.

Here below, we have mentioned all the inclusions of Core Tactics:

  • LOLBins
  • Exploits
  • Both off-the-shelf
  • Custom malware
  • Cobalt Strike
  • Metasploit

The initial breach showed that the Administrator-level RDP login failed without failed attempts, hinting at prior credential theft. 

Cuba’s toolkit, a mix of custom and off-the-shelf elements, presents similarities with past campaigns and their known tactics.

Tools, Exploits, and Tactics Used

Here below, we have mentioned all the tools, exploits, and tactics that the operators behind the Cuba ransomware group use:-

  • BUGHATCH
  • Metasploit DNS Stager
  • Wedgecut
  • Defense Evasion
  • BURNTCIGAR
  • CVE-2020-1472 — NetLogon
  • CVE-2023-27532 — Veeam
  • Cobalt Strike Beacon
  • Lateral movement
  • nltest utility
  • PSexec
  • Network management utility – net.exe
  • LOLBins
  • netpingall.exe
Main execution chain (source: BlackBerry)

Additionally, the strategy the Cuba ransomware group’s operators use suggests that the group has financial motivations.

Recommendations

Below, we have listed all the recommendations offered by the security researchers:

  • Keep network systems and system programs up-to-date with the latest patches and updates.
  • Deploy a proper patch management program for the quick prompt.
  • Make sure to implement a robust email gateway solution.
  • Ensure adequate segmentation for networks.
  • Use a robust data backup solution for up-to-date, comprehensive data backup.
  • Always use a robust endpoint protection platform, AV tools, and other necessary modern firewall solutions.
  • Use Multi-Factor Authentication (2FA) solutions wherever possible.
  • Ensure the use of VPNs.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

SHA256 Hash Calculation from Data Chunks

The SHA256 algorithm, a cryptographic hash function, is widely used for securing data integrity...

New Report of of 1M+ Malware Samples Show Application Layer Abused for Stealthy C2

A recent analysis of over one million malware samples by Picus Security has revealed...

Seven-Year-Old Linux Kernel Bug Opens Door to Remote Code Execution

Researchers have uncovered a critical vulnerability in the Linux kernel, dating back seven years,...

Ransomware Payments Plunge 35% as More Victims Refuse to Pay

In a significant shift within the ransomware landscape, global ransom payments plummeted by 35%...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Ransomware Payments Plunge 35% as More Victims Refuse to Pay

In a significant shift within the ransomware landscape, global ransom payments plummeted by 35%...

NetSupport RAT Grant Attackers Full Access to Victims Systems

The eSentire Threat Response Unit (TRU) has reported a significant rise in incidents involving...

Cisco Data Breach – Ransomware Group Allegedly Breached Internal Network

Sensitive credentials from Cisco's internal network and domain infrastructure were reportedly made public due...