Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Over 100 Organizations Hit by Cuba Ransomware: CISA, FBI

Cuba ransomware attacks on critical infrastructure have continued in 2022, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) warn.

Cuba ransomware attacks on critical infrastructure have continued in 2022, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) warn.

Active since late 2019, Cuba ransomware is known for appending the ‘.cuba’ extension to encrypted files, and was previously seen being distributed via a malware loader called Hancitor, which typically provides threat actors with access to compromised networks.

In December 2021, the FBI issued an alert on Cuba ransomware operations, warning that the cybercriminals behind it might have received over $43 million in ransom payments from their victims.

In a joint alert published this week, CISA and the FBI have updated the figure to $60 million, saying that more than 100 organizations have been compromised as of August 2022.

The ransomware has been used in attacks targeting organizations in the financial, government, healthcare, IT, and manufacturing sectors.

“Since spring 2022, Cuba ransomware actors have modified their TTPs and tools to interact with compromised networks and extort payments from victims,” CISA and the FBI say.

The threat actors continue to compromise target networks via known software vulnerabilities, phishing, stolen credentials, and legitimate remote desktop protocol (RDP) tools. They also attempt to elevate privileges on the compromised systems.

Cuba ransomware operators have been observed exploiting CVE-2022-24521 (a vulnerability in the Windows CLFS driver), using a PowerShell script for reconnaissance, using KerberCache to extract cached Kerberos tickets, and exploiting CVE-2020-1472 (ZeroLogon) to obtain domain administrative privileges.

Advertisement. Scroll to continue reading.

“Cuba ransomware actors use tools to evade detection while moving laterally through compromised environments before executing Cuba ransomware,” the two agencies note.

In addition to encrypting victims’ files, the threat actors also exfiltrate data and threaten to release it publicly unless a ransom payment is made.

In an August 2022 report, Palo Alto Networks noted that Cuba ransomware operators have started using the RomCom RAT for command-and-control (C&C). The malware is known for targeting food brokers, foreign military organizations, IT organizations, and manufacturers.

Cuba ransomware operators may also be using the Industrial Spy ransomware and have been observed using Industrial Spy’s online marketplace to sell data exfiltrated from victims.

The threat actors also appear to have been involved in a disruptive attack on Montenegro, which has been attributed to Russia-linked hackers.

Related: Hive Ransomware Gang Hits 1,300 Businesses, Makes $100 Million

Related: US Healthcare Organizations Warned of ‘Daixin Team’ Ransomware Attacks

Related: FBI: 649 Ransomware Attacks Reported on Critical Infrastructure Organizations in 2021

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Ransomware

A SaaS ransomware attack against a company’s Sharepoint Online was done without using a compromised endpoint.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.