Loading malware…
Cuba ransomware, also tracked by some vendors as COLDDRAW, is a Windows ransomware family active since 2019 that conducts double-extortion operations by encrypting victim data and threatening to publish stolen information. It has primarily targeted enterprise environments, including critical infrastructure and government organizations, with a notable concentration of victims in the United States.
Cuba is designed to encrypt both local files and network shares. Reported variants support modes for encrypting local volumes, specified paths, discovered network shares, and shares on specified remote systems. The malware performs extensive pre-encryption discovery, including process enumeration, network share discovery via native APIs, and local network discovery such as ARP cache retrieval. It commonly terminates processes and services associated with databases, virtualization platforms, Outlook, and Microsoft Exchange to maximize file access before encryption. Public analyses describe its use of ChaCha20 for file encryption with RSA protection of per-file keys, and its addition of a distinctive encrypted-file marker and the .cuba extension.
The malware and its operators employ multiple defense-evasion and post-compromise techniques. Observed behavior includes hidden PowerShell execution, masquerading as legitimate security or VPN software, artifact deletion through command shell commands, and self-deletion after execution. Cuba intrusions have also involved lateral movement through obfuscated PowerShell scripts and broad enterprise encryption of local and shared resources.
Cuba has been delivered through several intrusion paths over time. Earlier activity linked the ransomware to Hancitor-delivered malicious document campaigns, while later operations increasingly relied on exploitation of public-facing Microsoft Exchange vulnerabilities, including ProxyShell and ProxyLogon, to gain initial access. Reporting also associates Cuba operations with custom tooling such as BUGHATCH and with broader post-exploitation ecosystems involving Cobalt Strike, credential theft utilities, and security-tool-disabling components.
The ransomware operation has been tracked under actor designations including UNC2596 and Tropical Scorpius. Associated campaigns have used commodity and custom tooling for reconnaissance, credential theft, privilege escalation, lateral movement, and defense evasion prior to ransomware deployment and data theft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues... ProxyShell is a set of three vulnerabilities in the Microsoft Exchange Server that allow remote code execution without authentication on vulnerable deployments. The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
Tropical Scorpius has also been observed exploiting vulnerabilities in Microsoft Exchange Server, including ProxyShell and ProxyLogon. | Beginning in early May 2022, Unit 42 observed a threat actor deploying Cuba Ransomware using novel tools and techniques.
Unit 42 observed the actor leverage a binary that abused CVE-2022-24521, a vulnerability in the Common Log File System (CLFS). The exploit abused a logic bug in CLFS.sys, specifically in the CClfsBaseFilePersisted::LoadContainerQ() function. Malformed BLF files were used to corrupt the pContainer field of a container context object with a user-mode address to gain code execution. The code execution was used to steal the System token and elevate privileges.
"The most severe of the problems addressed is CVE-2024-40711, a critical (CVSS v3.1 score: 9.8) remote code execution (RCE) vulnerability on Veeam Backup & Replication (VBR) that can be exploited without authentication."
Next the threat actors attempted to use a file called zero.exe, which is used to exploit the Zerologon vulnerability to escalate privileges.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GuidePoint’s DFIR team was engaged by a client to respond to a confirmed Cuba ransomware attack... The .cuba file extension and references within the ransom note were explicit indications of which group we were dealing with.
Elastic Security Team is tracking an organized and financially-motivated ransomware and extortion group called Cuba Ransomware... deploying ransomware... uses a “name and shame” approach
"Their ransomware arsenal evolved over time: Cuba ransomware (early 2020)..."
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Может распространяться путём взлома через незащищенную конфигурацию RDP...
...обманных загрузок, ботнетов, эксплойтов, вредоносной рекламы, веб-инжектов, фальшивых обновлений...
AppleSeed has the ability to execute its payload via PowerShell... APT19 used PowerShell commands to execute payloads... APT28 downloads and executes PowerShell scripts and performs PowerShell commands... Start-Process / Invoke-Command / System.Management.Automation
Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Process Termination CUBA starts by acquiring SeDebugPrivilege and then terminates a hardcoded list of processes and services...
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
Numerous entries mention enumerating drives, logical disks, disk type, free space, or volume information; examples include 'Babuk can enumerate disk volumes,' 'Cuba can enumerate local drives,' and 'TAINTEDSCRIBE can use DriveList to retrieve drive information.'
76 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
66 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware that encrypts files in corporate networks using AES, appends the .cuba extension, drops ransom notes, and demands payment for a private decryption key. The content also states operators claimed to exfiltrate databases, FTP servers, and file servers before extortion.
A named ransomware family mentioned only to clarify that, despite its name, it likely did not originate from Cuba.
Ransomware that executes PowerShell in hidden windows for stealth.
Ransomware family/gang linked to attacks targeting Veeam Backup & Replication (VBR) vulnerabilities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.