Loading story…
Trend Micro reported renewed activity by the Cuba ransomware group and identified a new variant that refined both intrusion and encryption behavior. The malware used BUGHATCH, a custom downloader, during staging and appeared modified to improve execution reliability while reducing unintended system impact. Researchers said the variant expanded the list of terminated processes and services before encryption, including SQL, virtualization platforms, Outlook, and Microsoft Exchange components, while also widening its safelist of directories and file extensions to avoid encrypting files that could disrupt operations or the attack itself.
A later sample observed against two organizations in Asia showed the group sharpening its extortion playbook. The revised ransom note explicitly threatened to publish exfiltrated data after three days if victims did not engage, and it added qTox/quTox contact details to support negotiations. Trend Micro said the same onion site appeared across ransom notes, linking the incidents to the same operation and indicating that Cuba’s ransomware campaign remained active and evolving.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Trend Micro said detections of new Cuba ransomware samples in May 2022 suggested the group's attacks would continue in the coming months.
Trend Micro said the latest variant's ransom note added qTox/quTox contact details as a technical support channel to facilitate ransom payment negotiations.
The late-April 2022 variant used a revised ransom note that threatened to publish exfiltrated data on the group's Tor site after three days if victims did not negotiate, indicating double extortion.
Trend Micro observed another Cuba ransomware variant in late April 2022 targeting two organizations in Asia.
Samples examined from March and April 2022 used the custom downloader BUGHATCH during the staging phase, a technique Trend Micro said previous Cuba variants had not used.
Trend Micro reported a resurgence of Cuba ransomware activity during March and April 2022 and analyzed samples from that period.
The report cited an FBI official notice stating that Cuba ransomware resurfaced in November 2021.
Trend Micro said the Cuba ransomware malware family was first observed in February 2020.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cuba ransomware operation, also tracked by some researchers as **Tropical Scorpius** or **REF9019**, has grown from a file-encrypting malware family into a mature double-extortion threat that steals data before encryption and pressures victims through leak sites. Researchers said the malware appends the `.cuba` extension, prepends encrypted files with the `FIDEL.CA` marker, and drops ransom notes including **`!! READ ME !!.txt`** and earlier variants such as **`!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT`**. Reporting tied the group to more than 100 victims and tens of millions of dollars in ransom payments, with U.S.-based organizations disproportionately affected and some incidents triggering downstream breach notifications across public-sector entities. Technical analyses show Cuba ransomware can encrypt local disks, selected paths, network shares, and shares on specified IP addresses while using multithreading to speed encryption and avoid corruption. The malware uses **ChaCha20** for file encryption and **RSA/RSA-4096** to protect per-file keys, acquires elevated privileges, terminates database, virtualization, Outlook, and Exchange-related processes, and avoids execution on systems using Russian keyboard settings. Investigators also observed the operators using **ROMCOM RAT**, **KerberCache**, **Mimikatz**, **ADFind**, **Net Scan**, **GetUserSPNs.ps1**, **ZeroLogon**, and a **CLFS** privilege-escalation exploit for `CVE-2022-24521`, while broader reporting on Exchange exploitation highlighted how attackers commonly chain internet-facing flaws, deploy web shells, and exfiltrate data before launching follow-on ransomware activity.
Aug 21, 2026
Threat actors used unpatched **Microsoft Exchange** servers as an initial access point to deploy both **Babuk** and **Cuba** ransomware, with campaigns heavily affecting organizations in the United States and additional victims in other countries. Cisco Talos reported that a newer actor it tracks as **Tortilla** likely exploited **ProxyShell** to compromise Exchange, install the **China Chopper** web shell, stage payloads with PowerShell, and ultimately launch Babuk ransomware that appended the `.babyk` extension after disabling backup-related services and deleting VSS snapshots. A separate intrusion set tied to **Cuba ransomware** also abused Exchange flaws, including **ProxyShell** and **ProxyLogon**, to breach corporate networks and deploy ransomware at scale. Mandiant said the actors, tracked as **UNC2596** and associated with **COLDDRAW**, combined public Exchange exploitation with tools such as **Bughatch**, **Wedgecut**, **Burntcigar**, and **Termite** to maintain persistence, escalate privileges, move laterally, and disable defenses; the activity followed earlier FBI reporting that Cuba had compromised dozens of U.S. critical infrastructure organizations, underscoring the continued risk from internet-exposed, unpatched Exchange servers.
Sep 3, 2026
Mandiant reported that threat actor **UNC2596** has been exploiting publicly known vulnerabilities in **Microsoft Exchange** and **Fortinet FortiOS** appliances to gain initial access and deploy **Cuba ransomware**. The activity shows the group chaining edge-device compromise with post-exploitation movement inside victim environments, using exposed enterprise infrastructure as an entry point before staging ransomware operations. The intrusion pattern highlights how attackers continue to weaponize unpatched perimeter systems to reach internal networks and deliver financially motivated payloads. Mandiant linked the observed operations to Cuba ransomware deployment, underscoring the ongoing risk from internet-facing appliances and email infrastructure when critical vulnerabilities remain unremediated.
Jul 12, 2026