The FBI has identified, as of early November 2021 that Cuba ransomware actors have compromised at least 49 entities in five critical infrastructure sectors, including but not limited to the financial, government, healthcare, manufacturing, and information technology sectors, an alert posted last Thursday by the agency stated.
“Cuba ransomware is distributed through Hancitor malware, a loader known for dropping or executing stealers, such as Remote Access Trojans (RATs) and other types of ransomware, onto victims’ networks. Hancitor malware actors use phishing emails, Microsoft Exchange vulnerabilities, compromised credentials, or legitimate Remote Desktop Protocol (RDP) tools to gain initial access to a victim’s network.
Subsequently, Cuba ransomware actors use legitimate Windows services—such as PowerShell, PsExec, and other unspecified services—and then leverage Windows Admin privileges to execute their ransomware and other processes remotely. Cuba ransomware actors compromise a victim network through the encryption of target files with the “.cuba” extension. Cuba ransomware actors have demanded at least US $74 million and received at least US $43.9 million in ransom payments”, the FBI explained.
In a bid to stop the Cuba ransomware actors, the FBI announced that it is seeking any information that can be shared, to include boundary logs showing
communication to and from foreign IP addresses, Bitcoin wallet information, the decryptor file, and/or a benign sample of an encrypted file. The agency also clearly stated it does not encourage victims to pay the ransom, as that does not guarantee that the files will be recovered, and could even embolden other groups to target additional organisations. Recognising that paying the ransom is sometimes inevitable, the FBI urged victims to report ransomware incidents to their local field office, which provides critical information needed to prevent future attacks by identifying and tracking ransomware attackers and holding them accountable.
