The FBI has identified, as of early November 2021 that Cuba ransomware actors have compromised at least 49 entities in five critical infrastructure sectors, including but not limited to the financial, government, healthcare, manufacturing, and information technology sectors, an alert posted last Thursday by the agency stated.
“Cuba ransomware is distributed through Hancitor malware, a loader known for dropping or executing stealers, such as Remote Access Trojans (RATs) and other types of ransomware, onto victims’ networks. Hancitor malware actors use phishing emails, Microsoft Exchange vulnerabilities, compromised credentials, or legitimate Remote Desktop Protocol (RDP) tools to gain initial access to a victim’s network.
Subsequently, Cuba ransomware actors use legitimate Windows services—such as PowerShell, PsExec, and other unspecified services—and then leverage Windows Admin privileges to execute their ransomware and other processes remotely. Cuba ransomware actors compromise a victim network through the encryption of target files with the “.cuba” extension. Cuba ransomware actors have demanded at least US $74 million and received at least US $43.9 million in ransom payments”, the FBI explained.
In a bid to stop the Cuba ransomware actors, the FBI announced that it is seeking any information that can be shared, to include boundary logs showing
communication to and from foreign IP addresses, Bitcoin wallet information, the decryptor file, and/or a benign sample of an encrypted file. The agency also clearly stated it does not encourage victims to pay the ransom, as that does not guarantee that the files will be recovered, and could even embolden other groups to target additional organisations. Recognising that paying the ransom is sometimes inevitable, the FBI urged victims to report ransomware incidents to their local field office, which provides critical information needed to prevent future attacks by identifying and tracking ransomware attackers and holding them accountable.
The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY
Follow Us
© 2015 – 2019 IT Security Guru – Website Managed by Calm Logic
© 2015 – 2019 IT Security Guru – Website Managed by Calm Logic
This site uses functional cookies and external scripts to improve your experience.
Privacy Settings / PENDING
This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.
NOTE: These settings will only apply to the browser and device you are currently using.
GDPR Compliance


You May Also Like

North Korea Allegedly Stole Millions of Dollars Worth of Crypto Assets

According to a confidential United Nations (UN) report seen by Reuters on…

Most Inspiring Women in Cyber 2021: Marilise de Villiers, Founder & CEO of ROAR! Coaching and Consulting

The IT Security Guru’s Most Inspiring Women in Cyber Awards aims to…

Hack The Box launches its annual University CTF to inspire the next generation of security professionals to take the fight against cybercriminals

As the cyber skills gap widens to record new levels, disruptive cybersecurity…

Searchlight Security Announces New Automated Reporting Function

Searchlight Security, the dark web intelligence company, has announced a new automated…