Loading malware…
Cuba ransomware is a Windows ransomware family active since 2019 that is associated with a financially motivated intrusion set tracked by multiple vendors as UNC2596 and Tropical Scorpius. It is known for double-extortion operations in which victim data is exfiltrated and victims are threatened with public release if payment is not made. Reporting has linked the operation to significant targeting of U.S. organizations, including critical infrastructure, with additional victims observed in government, financial services, healthcare, information technology, and manufacturing environments.
Cuba has historically been delivered through Hancitor malspam campaigns and later through exploitation of public-facing services, especially Microsoft Exchange vulnerabilities such as ProxyShell and ProxyLogon. More recent reporting also links the group to exploitation of backup infrastructure vulnerabilities including CVE-2023-27532 in Veeam Backup & Replication. Operators have also been observed using initial access brokers and misconfigured internet-facing systems.
On compromised Windows systems, Cuba supports encryption of local files and network shares and includes modes for encrypting specific paths, local volumes, or shares discovered across the network. It uses built-in APIs such as GetIpNetTable and NetShareEnum for network discovery, including ARP-table retrieval and share enumeration. The malware can enumerate running processes, terminate processes and services that may interfere with encryption, and target SQL, virtualization, Outlook, and Microsoft Exchange components. It has been observed executing hidden PowerShell windows, using obfuscated PowerShell scripts for deployment and lateral movement, deleting artifacts from infected systems, and masquerading as legitimate software such as security or VPN products.
Technically, Cuba uses ChaCha20 for file encryption and RSA-4096 or equivalent RSA-based protection for per-file encryption material, prepending a marker-bearing header to encrypted files and appending a characteristic ransomware extension. It can self-delete after execution and has been reported to avoid encrypting systems configured with Russian keyboard layouts. Associated intrusion activity has included use of custom and commodity tooling such as BUGHATCH, WEDGECUT, BURNTCIGAR, TERMITE, ROMCOM RAT, Cobalt Strike, Mimikatz, and PowerShell-based tooling for reconnaissance, credential theft, privilege escalation, defense evasion, and lateral movement. Observed operator tradecraft has also included exploitation of CVE-2022-24521 and use of vulnerable-driver techniques to disable security products.
Cuba is best characterized as an enterprise-targeting ransomware operation that combines opportunistic exploitation of newly disclosed vulnerabilities with hands-on-keyboard post-exploitation, data theft, and disruptive encryption across Windows environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Following the publication of a report regarding the Cuba ransomware group’s recent activities, the STRIKE Team leveraged SecurityScorecard’s unique data to enrich the indicators of compromise linked to this activity.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues... ProxyShell is a set of three vulnerabilities in the Microsoft Exchange Server that allow remote code execution without authentication on vulnerable deployments. The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
Tropical Scorpius has also been observed exploiting vulnerabilities in Microsoft Exchange Server, including ProxyShell and ProxyLogon. | Beginning in early May 2022, Unit 42 observed a threat actor deploying Cuba Ransomware using novel tools and techniques.
Unit 42 observed the actor leverage a binary that abused CVE-2022-24521, a vulnerability in the Common Log File System (CLFS). The exploit abused a logic bug in CLFS.sys, specifically in the CClfsBaseFilePersisted::LoadContainerQ() function. Malformed BLF files were used to corrupt the pContainer field of a container context object with a user-mode address to gain code execution. The code execution was used to steal the System token and elevate privileges.
"The most severe of the problems addressed is CVE-2024-40711, a critical (CVSS v3.1 score: 9.8) remote code execution (RCE) vulnerability on Veeam Backup & Replication (VBR) that can be exploited without authentication."
Next the threat actors attempted to use a file called zero.exe, which is used to exploit the Zerologon vulnerability to escalate privileges.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GuidePoint’s DFIR team was engaged by a client to respond to a confirmed Cuba ransomware attack... The .cuba file extension and references within the ransom note were explicit indications of which group we were dealing with.
Elastic Security Team is tracking an organized and financially-motivated ransomware and extortion group called Cuba Ransomware... deploying ransomware... uses a “name and shame” approach
"Their ransomware arsenal evolved over time: Cuba ransomware (early 2020)..."
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Может распространяться путём взлома через незащищенную конфигурацию RDP...
...обманных загрузок, ботнетов, эксплойтов, вредоносной рекламы, веб-инжектов, фальшивых обновлений...
AppleSeed has the ability to execute its payload via PowerShell... APT19 used PowerShell commands to execute payloads... APT28 downloads and executes PowerShell scripts and performs PowerShell commands... Start-Process / Invoke-Command / System.Management.Automation
Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Process Termination CUBA starts by acquiring SeDebugPrivilege and then terminates a hardcoded list of processes and services...
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
Numerous entries mention enumerating drives, logical disks, disk type, free space, or volume information; examples include 'Babuk can enumerate disk volumes,' 'Cuba can enumerate local drives,' and 'TAINTEDSCRIBE can use DriveList to retrieve drive information.'
82 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
67 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware that encrypts files in corporate networks using AES, appends the .cuba extension, drops ransom notes, and demands payment for a private decryption key. The content also states operators claimed to exfiltrate databases, FTP servers, and file servers before extortion.
A named ransomware family mentioned only to clarify that, despite its name, it likely did not originate from Cuba.
Ransomware that executes PowerShell in hidden windows for stealth.
A ransomware family/group active since 2019. In this reference it is discussed as the operator associated with BUGHATCH infrastructure and as exploiting CVE-2023-27532 against Veeam Backup & Replication to pressure victims by compromising backup and recovery options.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.