cuba

T1078.003Valid Accounts: Local Accounts

Operators leveraged valid local accounts for initial access.

T1133External Remote Services

Cuba ransomware operators used external remote services for initial access.

T1059.001Command and Scripting Interpreter: PowerShell

Cuba ransomware operators executed PowerShell commands during the attack.

T1059.003Command and Scripting Interpreter: Windows Command Shell

The Windows Command Shell was used to execute various commands during the attack.

T1106Native API

Cuba ransomware used native API calls to execute malicious behaviors.

T1204.002User Execution: Malicious File

Malicious files were used to trick users into executing ransomware.

T1569.002System Services: Service Execution

Cuba ransomware was executed using Windows system services.

T1036.005Masquerading: Match Legitimate Name or Location

The ransomware used legitimate names or locations to evade detection.

T1068Exploitation for Privilege Escalation

Cuba ransomware exploited vulnerabilities to escalate privileges.

T1021.002Remote Services: External Remote Services

Remote services were used to gain access to systems during the attack.

T1212Exploitation for Credential Access

Cuba ransomware operators exploited vulnerabilities to gain credential access.

T1016.001Network Configuration Discovery: Network Connection Enumeration

Network connections were enumerated for discovery purposes.

T1018Remote System Discovery

Remote systems were discovered using built-in utilities.

T1057Process Discovery

Running processes were identified during the attack.

T1083File and Directory Discovery

Files and directories were enumerated during the attack.

T1124Time Discovery

Cuba ransomware operators performed time discovery on infected systems.

T1135Network Share Discovery

Network shares were enumerated by the ransomware.

T1333External Remote Services

Operators utilized external remote services to move laterally within the network.

T1570Tool Transfer

Cuba ransomware operators used tool transfer for lateral movement.

T1071.001Application Layer Protocol: Web Protocols

Web protocols such as HTTP and HTTPS were used for communication.

T1071.004Application Layer Protocol: DNS

DNS was used as a protocol for command and control communication.

T1090.003Multi-hop Proxy

Cuba ransomware operators used multi-hop proxies to obfuscate communication.

T1219Remote Desktop Protocol

The operators used Remote Desktop Protocol (RDP) for command and control.