cuba

· InactiveThe Cuba Ransomware, also known as Colddraw Ransomware, was first identified in the threat landscape in 2019 and built a relatively small but selected list of victims. The group is also known as Fidel Ransomware, due to a characteristic marker placed at the beginning of all encrypted files. This file marker is used as an indicator for the ransomware and its decoder that the file has been encrypted. Despite its name and the Cuban nationalist style on its leak site, it is difficult to assert any connection or affiliation with the Republic of Cuba. The group has been linked to a Russian-language threat actor by Profero researchers due to some details of incorrect translation they discovered, as well as the discovery of a 404 page containing text in Russian on the threat actor's own leak site. According to BlackBerry, based on the analysis of the code strings used in the campaign analyzed in 2023, there were indications that the developer behind the Cuba ransomware speaks Russian. The ransomware operators use a double extortion approach, and following the USA, in August 2022, it was believed that the Cuba ransomware group had compromised 101 entities, demanding $145 million in ransom payments and receiving up to $60 million. The group used a similar set of TTPs, with only a slight change each year, as they generally consist of LOLBins (executables that are part of the operating system and can be exploited to support an attack), exploits, off-the-shelf and custom malware, as well as intrusion tools like Cobalt Strike and Metasploit. In 2022, the group allegedly developed a relationship with operators of the Industrial Spy market, using their platform as a means of data leakage. Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

105

Status

Inactive

Sites

Countries Hit

Profile

[CISA Alert aa22-335a](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-335a)

[Ransomware Spotlight: Cuba](https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-cuba)

https://securelist.com/cuba-ransomware/110533/

Top Countries

Unknown42

US24

GB10

CA5

CN2

IT2

IN2

TW2

DE2

AT1

Top Sectors

Unknown27

Technology16

Manufacturing7

Financial Services7

Recent Victims

View all 105 →

dms-imaging

FR · Healthcare

Feb 1, 2024

deknudtframes.be

BE · Manufacturing

Jan 22, 2024

diagnostechs

US · Healthcare

Nov 14, 2023

portadelaidefc

AU · Media and Entertainment

Nov 13, 2023

panaya

US · Technology

Nov 7, 2023

prime-art

— · Manufacturing

Nov 7, 2023

Newconcepttech

— · Technology

Oct 23, 2023