Loading story…
Researchers identified a new .NET ransomware family, HavanaCrypt, that disguises itself as a Google Software Update application while communicating with command-and-control infrastructure at 20[.]227[.]128[.]33, an IP address described as part of a Microsoft web hosting service. The malware is protected with Obfuscar, performs multiple anti-virtualization checks, fingerprints infected systems, and contacts ham.php and index.php to retrieve a token, date, and encryption-related material before launching file encryption.
HavanaCrypt weakens defenses by downloading a batch file to reduce Windows Defender protections, kills numerous processes, deletes shadow copies and restore points, and persists by copying itself into startup-related directories. During encryption it uses components associated with KeePass Password Safe, including CryptoRandom, stores an RSA key in hava.info, records encrypted directories in foo.txt, and appends the .Havana extension to locked files. Researchers noted that the malware did not drop a ransom note, indicating the ransomware may still have been under development at the time of analysis.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro researchers published an analysis of a new ransomware family they named HavanaCrypt, describing its masquerade as a Google Software Update application, its Microsoft-hosted C2 infrastructure, and its encryption behavior. The report noted the malware did not drop a ransom note, suggesting it may still have been under development at the time of analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cuba ransomware operation, also tracked by some researchers as **Tropical Scorpius** or **REF9019**, has grown from a file-encrypting malware family into a mature double-extortion threat that steals data before encryption and pressures victims through leak sites. Researchers said the malware appends the `.cuba` extension, prepends encrypted files with the `FIDEL.CA` marker, and drops ransom notes including **`!! READ ME !!.txt`** and earlier variants such as **`!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT`**. Reporting tied the group to more than 100 victims and tens of millions of dollars in ransom payments, with U.S.-based organizations disproportionately affected and some incidents triggering downstream breach notifications across public-sector entities. Technical analyses show Cuba ransomware can encrypt local disks, selected paths, network shares, and shares on specified IP addresses while using multithreading to speed encryption and avoid corruption. The malware uses **ChaCha20** for file encryption and **RSA/RSA-4096** to protect per-file keys, acquires elevated privileges, terminates database, virtualization, Outlook, and Exchange-related processes, and avoids execution on systems using Russian keyboard settings. Investigators also observed the operators using **ROMCOM RAT**, **KerberCache**, **Mimikatz**, **ADFind**, **Net Scan**, **GetUserSPNs.ps1**, **ZeroLogon**, and a **CLFS** privilege-escalation exploit for `CVE-2022-24521`, while broader reporting on Exchange exploitation highlighted how attackers commonly chain internet-facing flaws, deploy web shells, and exfiltrate data before launching follow-on ransomware activity.
Aug 21, 2026
Trend Micro reported renewed activity by the **Cuba ransomware** group and identified a new variant that refined both intrusion and encryption behavior. The malware used **BUGHATCH**, a custom downloader, during staging and appeared modified to improve execution reliability while reducing unintended system impact. Researchers said the variant expanded the list of terminated processes and services before encryption, including **SQL**, virtualization platforms, **Outlook**, and **Microsoft Exchange** components, while also widening its safelist of directories and file extensions to avoid encrypting files that could disrupt operations or the attack itself. A later sample observed against two organizations in Asia showed the group sharpening its extortion playbook. The revised ransom note explicitly threatened to publish exfiltrated data after three days if victims did not engage, and it added **qTox/quTox** contact details to support negotiations. Trend Micro said the same onion site appeared across ransom notes, linking the incidents to the same operation and indicating that Cuba’s ransomware campaign remained active and evolving.
Aug 15, 2026
Researchers analyzed **HildaCrypt**, a Windows ransomware family written in C# that was distributed as a fake XAMPP installer named `xamp.exe` and obfuscated with **ConfuserEx**. Once launched, it created a GUID-named folder under `%AppData%\Roaming%`, ran a batch script, deleted shadow copies, and attempted to stop SQL, backup, and anti-malware services before encrypting files. The malware used **AES-256-CBC** for file encryption, appended the `.HCY!` extension, and stored the AES key and IV in each file after encrypting them with an embedded **RSA-2048** public key; it then dropped an HTML ransom note, `HILDACRYPTReadMe.html`, directing victims to contact the operator by email. A separate development reduced the threat to victims after the ransomware’s developer released HildaCrypt’s master private decryption keys. Researcher **GrujaRS** had initially classified a sample as a STOP ransomware variant, but the author later said it was a HildaCrypt variant, and **Michael Gillespie** confirmed the keys were valid and published a working decryptor. The developer claimed the malware was created for “fun” and educational purposes, said it had not been used against anyone, and indicated development was likely ending as they moved toward legitimate cybersecurity work.
Aug 15, 2026