FBI Posts Formal Notice Concerning the Cuba Ransomware
Late last week the FBI's Cyber Division released a flash alert concerning the Cuba ransomware. The purpose of the document was to raise awareness of the ransomware variant and inform the public of the impact it has had so far.
According to the flash alert, the party operating the Cuba ransomware has so far managed to score successful attacks against "at least" 49 different entities. As a result of those attacks, the FBI has estimated that the crooks running the Cuba ransomware have pocketed "at least" a staggering $43.9 million from operating their cybercriminal gang.
The Cuba ransomware is targeting Windows-based infrastructure and entities operating within a wide range of sectors, from finance to government, IT and healthcare.
The vehicle used to spread the Cuba ransomware is most often the Hancitor malware, the FBI further informs. The Hancitor tool is a relatively popular dropper used to spread other kinds of malware as well, from remote access trojans to different strains of ransomware.
The Hancitor operators use a wide array of tools to gain access and compromise networks as well. Those range from attempts at phishing victim employees to using stolen credentials and abusing remote desktop tools.
Once the loader has offloaded the ransomware on the victim system, hackers operating the Cuba ransomware proceed to abuse legitimate Windows system tools such as PowerShell, obtain admin privileges and execute the final Cuba payload.
Cuba also installs a Cobalt Strike beacon. Cobalt Strike is a legitimate "adversary simulation" tool that has become extremely popular with threat actors.
In addition to its data destruction and encryption capabilities, the Cuba ransomware also employs the MimiKatz malicious tool to exfiltrate credentials and use remote desktop to leverage those credentials. Cobalt Strike is then used to communicate between the compromised RDP account and the hackers.
Even though the bad actors operating the Cuba ransomware have so far harvested nearly $44 million, the total ransom demands made over the course of their successful attacks actually reached an exorbitant $74 million.
