Loading story…
Mandiant reported that threat actor UNC2596 has been exploiting publicly known vulnerabilities in Microsoft Exchange and Fortinet FortiOS appliances to gain initial access and deploy Cuba ransomware. The activity shows the group chaining edge-device compromise with post-exploitation movement inside victim environments, using exposed enterprise infrastructure as an entry point before staging ransomware operations.
The intrusion pattern highlights how attackers continue to weaponize unpatched perimeter systems to reach internal networks and deliver financially motivated payloads. Mandiant linked the observed operations to Cuba ransomware deployment, underscoring the ongoing risk from internet-facing appliances and email infrastructure when critical vulnerabilities remain unremediated.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Mandiant published research describing UNC2596 leveraging vulnerabilities to deploy Cuba ransomware, marking the public disclosure of the activity and associated threat reporting.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors used unpatched **Microsoft Exchange** servers as an initial access point to deploy both **Babuk** and **Cuba** ransomware, with campaigns heavily affecting organizations in the United States and additional victims in other countries. Cisco Talos reported that a newer actor it tracks as **Tortilla** likely exploited **ProxyShell** to compromise Exchange, install the **China Chopper** web shell, stage payloads with PowerShell, and ultimately launch Babuk ransomware that appended the `.babyk` extension after disabling backup-related services and deleting VSS snapshots. A separate intrusion set tied to **Cuba ransomware** also abused Exchange flaws, including **ProxyShell** and **ProxyLogon**, to breach corporate networks and deploy ransomware at scale. Mandiant said the actors, tracked as **UNC2596** and associated with **COLDDRAW**, combined public Exchange exploitation with tools such as **Bughatch**, **Wedgecut**, **Burntcigar**, and **Termite** to maintain persistence, escalate privileges, move laterally, and disable defenses; the activity followed earlier FBI reporting that Cuba had compromised dozens of U.S. critical infrastructure organizations, underscoring the continued risk from internet-exposed, unpatched Exchange servers.
Sep 3, 2026
The Cuba ransomware operation, also tracked by some researchers as **Tropical Scorpius** or **REF9019**, has grown from a file-encrypting malware family into a mature double-extortion threat that steals data before encryption and pressures victims through leak sites. Researchers said the malware appends the `.cuba` extension, prepends encrypted files with the `FIDEL.CA` marker, and drops ransom notes including **`!! READ ME !!.txt`** and earlier variants such as **`!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT`**. Reporting tied the group to more than 100 victims and tens of millions of dollars in ransom payments, with U.S.-based organizations disproportionately affected and some incidents triggering downstream breach notifications across public-sector entities. Technical analyses show Cuba ransomware can encrypt local disks, selected paths, network shares, and shares on specified IP addresses while using multithreading to speed encryption and avoid corruption. The malware uses **ChaCha20** for file encryption and **RSA/RSA-4096** to protect per-file keys, acquires elevated privileges, terminates database, virtualization, Outlook, and Exchange-related processes, and avoids execution on systems using Russian keyboard settings. Investigators also observed the operators using **ROMCOM RAT**, **KerberCache**, **Mimikatz**, **ADFind**, **Net Scan**, **GetUserSPNs.ps1**, **ZeroLogon**, and a **CLFS** privilege-escalation exploit for `CVE-2022-24521`, while broader reporting on Exchange exploitation highlighted how attackers commonly chain internet-facing flaws, deploy web shells, and exfiltrate data before launching follow-on ransomware activity.
Aug 21, 2026
Trend Micro reported renewed activity by the **Cuba ransomware** group and identified a new variant that refined both intrusion and encryption behavior. The malware used **BUGHATCH**, a custom downloader, during staging and appeared modified to improve execution reliability while reducing unintended system impact. Researchers said the variant expanded the list of terminated processes and services before encryption, including **SQL**, virtualization platforms, **Outlook**, and **Microsoft Exchange** components, while also widening its safelist of directories and file extensions to avoid encrypting files that could disrupt operations or the attack itself. A later sample observed against two organizations in Asia showed the group sharpening its extortion playbook. The revised ransom note explicitly threatened to publish exfiltrated data after three days if victims did not engage, and it added **qTox/quTox** contact details to support negotiations. Trend Micro said the same onion site appeared across ransom notes, linking the incidents to the same operation and indicating that Cuba’s ransomware campaign remained active and evolving.
Aug 15, 2026