cuba

103 tracked victims

·first seen 2021-02-03·last activity 2024-02-01

Activity analysis

HackerFeeds has tracked 103 victims claimed by cuba since February 2021, most recently in February 2024 — ranking #73 of 332 groups (0.3% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in February 2024. Its most-targeted sector is Manufacturing (14 victims), followed by Technology (11). The United Kingdom accounts for 3 victims (30% of those with a known location); 93 victims did not disclose a location.

Victims per year

202113
202274
202314
20242

Top sectors

Manufacturing14
Technology11
Financial Services11
Business Services11
Public Sector7
Healthcare6

Top countries

Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology

Group profile

The Cuba Ransomware, also known as Colddraw Ransomware, was first identified in the threat landscape in 2019 and built a relatively small but selected list of victims. The group is also known as Fidel Ransomware, due to a characteristic marker placed at the beginning of all encrypted files. This file marker is used as an indicator for the ransomware and its decoder that the file has been encrypted. Despite its name and the Cuban nationalist style on its leak site, it is difficult to assert any connection or affiliation with the Republic of Cuba. The group has been linked to a Russian-language threat actor by Profero researchers due to some details of incorrect translation they discovered, as well as the discovery of a 404 page containing text in Russian on the threat actor's own leak site. According to BlackBerry, based on the analysis of the code strings used in the campaign analyzed in 2023, there were indications that the developer behind the Cuba ransomware speaks Russian. The ransomware operators use a double extortion approach, and following the USA, in August 2022, it was believed that the Cuba ransomware group had compromised 101 entities, demanding $145 million in ransom payments and receiving up to $60 million. The group used a similar set of TTPs, with only a slight change each year, as they generally consist of LOLBins (executables that are part of the operating system and can be exploited to support an attack), exploits, off-the-shelf and custom malware, as well as intrusion tools like Cobalt Strike and Metasploit. In 2022, the group allegedly developed a relationship with operators of the Industrial Spy market, using their platform as a means of data leakage. Source: https://github.com/crocodyli/ThreatActors-TTPs

MITRE ATT&CK TTPs

TA0001

Initial Access

T1078.003Valid Accounts: Local Accounts
Operators leveraged valid local accounts for initial access.
T1133External Remote Services
Cuba ransomware operators used external remote services for initial access.

TA0002

Execution

T1059.001Command and Scripting Interpreter: PowerShell
Cuba ransomware operators executed PowerShell commands during the attack.
T1059.003Command and Scripting Interpreter: Windows Command Shell
The Windows Command Shell was used to execute various commands during the attack.
T1106Native API
Cuba ransomware used native API calls to execute malicious behaviors.
T1204.002User Execution: Malicious File
Malicious files were used to trick users into executing ransomware.
T1569.002System Services: Service Execution
Cuba ransomware was executed using Windows system services.

TA0005

Defense Evasion

T1036.005Masquerading: Match Legitimate Name or Location
The ransomware used legitimate names or locations to evade detection.
T1068Exploitation for Privilege Escalation
Cuba ransomware exploited vulnerabilities to escalate privileges.

TA0006

Credential Access

T1021.002Remote Services: External Remote Services
Remote services were used to gain access to systems during the attack.
T1212Exploitation for Credential Access
Cuba ransomware operators exploited vulnerabilities to gain credential access.

TA0007

Discovery

T1016.001Network Configuration Discovery: Network Connection Enumeration
Network connections were enumerated for discovery purposes.
T1018Remote System Discovery
Remote systems were discovered using built-in utilities.
T1057Process Discovery
Running processes were identified during the attack.
T1083File and Directory Discovery
Files and directories were enumerated during the attack.
T1124Time Discovery
Cuba ransomware operators performed time discovery on infected systems.
T1135Network Share Discovery
Network shares were enumerated by the ransomware.

TA0008

Lateral Movement

T1333External Remote Services
Operators utilized external remote services to move laterally within the network.
T1570Tool Transfer
Cuba ransomware operators used tool transfer for lateral movement.

TA0011

Command and Control

T1071.001Application Layer Protocol: Web Protocols
Web protocols such as HTTP and HTTPS were used for communication.
T1071.004Application Layer Protocol: DNS
DNS was used as a protocol for command and control communication.
T1090.003Multi-hop Proxy
Cuba ransomware operators used multi-hop proxies to obfuscate communication.
T1219Remote Desktop Protocol
The operators used Remote Desktop Protocol (RDP) for command and control.

Recent victims

No victims tracked yet.