The FBI has identified, as of early November 2021 that Cuba ransomware actors have compromised at least 49 entities in five critical infrastructure sectors, including but not limited to the financial, government, healthcare, manufacturing, and information technology sectors, an alert posted last Thursday by the agency stated.
“Cuba ransomware is distributed through Hancitor malware, a loader known for dropping or executing stealers, such as Remote Access Trojans (RATs) and other types of ransomware, onto victims’ networks. Hancitor malware actors use phishing emails, Microsoft Exchange vulnerabilities, compromised credentials, or legitimate Remote Desktop Protocol (RDP) tools to gain initial access to a victim’s network.
Subsequently, Cuba ransomware actors use legitimate Windows services—such as PowerShell, PsExec, and other unspecified services—and then leverage Windows Admin privileges to execute their ransomware and other processes remotely. Cuba ransomware actors compromise a victim network through the encryption of target files with the “.cuba” extension. Cuba ransomware actors have demanded at least US $74 million and received at least US $43.9 million in ransom payments”, the FBI explained.
In a bid to stop the Cuba ransomware actors, the FBI announced that it is seeking any information that can be shared, to include boundary logs showing
communication to and from foreign IP addresses, Bitcoin wallet information, the decryptor file, and/or a benign sample of an encrypted file. The agency also clearly stated it does not encourage victims to pay the ransom, as that does not guarantee that the files will be recovered, and could even embolden other groups to target additional organisations. Recognising that paying the ransom is sometimes inevitable, the FBI urged victims to report ransomware incidents to their local field office, which provides critical information needed to prevent future attacks by identifying and tracking ransomware attackers and holding them accountable.
The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY
Follow Us
© 2015 – 2019 IT Security Guru – Website Managed by Calm Logic
© 2015 – 2019 IT Security Guru – Website Managed by Calm Logic
This site uses functional cookies and external scripts to improve your experience.
Privacy Settings / PENDING
This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.
NOTE: These settings will only apply to the browser and device you are currently using.
GDPR Compliance


You May Also Like

WordPress Update Millions of Sites to patch a Critical Vulnerability Affecting the Ninja Forms Plugin

Content management system (CMS) provider WordPress has forcibly updated over a million…

A conversation with Andrew Clarke, Global Head of Channel and Strategic Alliances at One Identity

The COVID-19 pandemic and ensuing work-from-home revolution has thrust identity management to…

Cloudflare launches paid public bug bounty program

The American web infrastructure and website security company Cloudflare has announced the…

Cybersecurity Association of Maryland to set up Centres of Excellence

The Cybersecurity of Maryland, Inc (CAMI) announced today plans to expand its…