Cuba Ransomware Armed with New Weapons to Attack U.S Infrastructure

The Cuba ransomware seems to be gaining more pace with each passing year, and this ransomware has been operating and active since 2019.

Until now, the operators of the Cuba ransomware have executed several high-profile attacks to target many industries and sectors. Besides this, it has already completed various prominent cross-industry episodes throughout early 2023.

Cybersecurity analysts at the BlackBerry Threat Research team recently analyzed a June campaign in which they revealed that this ransomware group attacked critical US infrastructure and a Latin American IT integrator.

In a report shared with Cyber Security News, researchers attributed the Cuba ransomware group to being of Russian origin and actively targeting the infrastructure sector. 

It’s even been claimed that they have added a new set of tools to their arsenal along with CVE-2023-27532, the Veeam vulnerability.

Technical Analysis

Cuba ransomware (aka COLDDRAW, Fidel) strategically targeted a moderate victim pool, marking encrypted files for the ransomware’s and its decryptor’s identification.

Cuba ransomware makes use of a double-extortion approach for ransom from its victims, and it’s been revealed by U.S. law enforcement that till now it has compromised 101 entities from:

• 65 in the United States
• 36 outside the United

Within these 4 years, the operators of this ransomware group demanded $145 million in ransom from its victims and managed to accumulate $60 million.

Here below, we have mentioned all the inclusions of Core Tactics:

• LOLBins
• Exploits
• Both off-the-shelf
• Custom malware
• Cobalt Strike
• Metasploit

The initial breach showed that the Administrator-level RDP login failed without failed attempts, hinting at prior credential theft. 

Cuba’s toolkit, a mix of custom and off-the-shelf elements, presents similarities with past campaigns and their known tactics.

Tools, Exploits, and Tactics Used

Here below, we have mentioned all the tools, exploits, and tactics that the operators behind the Cuba ransomware group use:-

• BUGHATCH
• Metasploit DNS Stager
• Wedgecut
• Defense Evasion
• BURNTCIGAR
• CVE-2020-1472 — NetLogon
• CVE-2023-27532 — Veeam
• Cobalt Strike Beacon
• Lateral movement
• nltest utility
• PSexec
• Network management utility – net.exe
• LOLBins
• netpingall.exe

Additionally, the strategy the Cuba ransomware group’s operators use suggests that the group has financial motivations.

Recommendations

Below, we have listed all the recommendations offered by the security researchers:

• Keep network systems and system programs up-to-date with the latest patches and updates.
• Deploy a proper patch management program for the quick prompt.
• Make sure to implement a robust email gateway solution.
• Ensure adequate segmentation for networks.
• Use a robust data backup solution for up-to-date, comprehensive data backup.
• Always use a robust endpoint protection platform, AV tools, and other necessary modern firewall solutions.
• Use Multi-Factor Authentication (2FA) solutions wherever possible.
• Ensure the use of VPNs.