Wednesday, May 14, 2025
Homepasswordless authenticationCuba Ransomware Armed with New Weapons to Attack U.S Infrastructure

Cuba Ransomware Armed with New Weapons to Attack U.S Infrastructure

Published on

SIEM as a Service

Follow Us on Google News

The Cuba ransomware seems to be gaining more pace with each passing year, and this ransomware has been operating and active since 2019.

Until now, the operators of the Cuba ransomware have executed several high-profile attacks to target many industries and sectors. Besides this, it has already completed various prominent cross-industry episodes throughout early 2023.

Cybersecurity analysts at the BlackBerry Threat Research team recently analyzed a June campaign in which they revealed that this ransomware group attacked critical US infrastructure and a Latin American IT integrator.

- Advertisement - Google News

In a report shared with Cyber Security News, researchers attributed the Cuba ransomware group to being of Russian origin and actively targeting the infrastructure sector. 

It’s even been claimed that they have added a new set of tools to their arsenal along with CVE-2023-27532, the Veeam vulnerability.

Technical Analysis

Cuba ransomware (aka COLDDRAW, Fidel) strategically targeted a moderate victim pool, marking encrypted files for the ransomware’s and its decryptor’s identification.

Cuba ransomware leak site (Source – BlackBerry)

Cuba ransomware makes use of a double-extortion approach for ransom from its victims, and it’s been revealed by U.S. law enforcement that till now it has compromised 101 entities from:

  • 65 in the United States
  • 36 outside the United

Within these 4 years, the operators of this ransomware group demanded $145 million in ransom from its victims and managed to accumulate $60 million.

Here below, we have mentioned all the inclusions of Core Tactics:

  • LOLBins
  • Exploits
  • Both off-the-shelf
  • Custom malware
  • Cobalt Strike
  • Metasploit

The initial breach showed that the Administrator-level RDP login failed without failed attempts, hinting at prior credential theft. 

Cuba’s toolkit, a mix of custom and off-the-shelf elements, presents similarities with past campaigns and their known tactics.

Tools, Exploits, and Tactics Used

Here below, we have mentioned all the tools, exploits, and tactics that the operators behind the Cuba ransomware group use:-

  • BUGHATCH
  • Metasploit DNS Stager
  • Wedgecut
  • Defense Evasion
  • BURNTCIGAR
  • CVE-2020-1472 — NetLogon
  • CVE-2023-27532 — Veeam
  • Cobalt Strike Beacon
  • Lateral movement
  • nltest utility
  • PSexec
  • Network management utility – net.exe
  • LOLBins
  • netpingall.exe
Main execution chain (source: BlackBerry)

Additionally, the strategy the Cuba ransomware group’s operators use suggests that the group has financial motivations.

Recommendations

Below, we have listed all the recommendations offered by the security researchers:

  • Keep network systems and system programs up-to-date with the latest patches and updates.
  • Deploy a proper patch management program for the quick prompt.
  • Make sure to implement a robust email gateway solution.
  • Ensure adequate segmentation for networks.
  • Use a robust data backup solution for up-to-date, comprehensive data backup.
  • Always use a robust endpoint protection platform, AV tools, and other necessary modern firewall solutions.
  • Use Multi-Factor Authentication (2FA) solutions wherever possible.
  • Ensure the use of VPNs.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Microsoft Patch Tuesday May 2025 Released With the Fixes for 72 Flaws With 5 Actively Exploited 0-Day

Microsoft has released its May 2025 Patch Tuesday updates, addressing 72 security vulnerabilities across...

Ivanti Released Security Updates to Fix for the Mutiple RCE Vulnerabilities – Patch Now

Ivanti, a leading enterprise software provider, has released critical security updates addressing vulnerabilities across...

Fortinet FortiVoice Zero-day Vulnerability Actively Exploited in The Wild

A critical stack-based buffer overflow vulnerability (CWE-121) has been discovered in multiple Fortinet products,...

Ransomware Attacks Surge by 123% Amid Evolving Tactics and Strategies

The 2025 Third-Party Breach Report from Black Kite highlights a staggering 123% surge in...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Ransomware Attacks Surge by 123% Amid Evolving Tactics and Strategies

The 2025 Third-Party Breach Report from Black Kite highlights a staggering 123% surge in...

Cybercriminals Hide Undetectable Ransomware Inside JPG Images

A chilling new ransomware attack method has emerged, with hackers exploiting innocuous JPEG image...

New Mamona Ransomware Targets Windows Systems Using Abused Ping Command

Cybersecurity researchers are raising the alarm about a newly discovered commodity ransomware strain dubbed Mamona,...