Cuba ransomware has evolved to include pre-encryption data exfiltration and a public leak site to increase pressure on victims. Attacks leverage obfuscated PowerShell scripts for lateral movement and make use of dual‑use pentest tools and frameworks to evade detection. #CubaRansomware #CobaltStrike
Keypoints
- Cuba ransomware operators now exfiltrate victim data and publish it on a recently deployed leak site to increase impact and revenue.
- Adversaries had network access before encryption and collected information to maximize disruption.
- Attacks use obfuscated PowerShell scripts and multiple evasion techniques to move laterally and deploy the ransomware.
- Targets include financial institutions, industry, technology and logistics organizations across North/South America and Europe.
- Similar incidents have shown use of Cobalt Strike and other dual‑use tools, though no definitive link between Cobalt Strike and Cuba ransomware was confirmed.
- Common entry vectors: spearphishing (emails), exploited public‑facing applications, and use of valid accounts or credentials obtained via infostealers; defenders should monitor dual‑use tools and abnormal WMIC activity.
MITRE Techniques
- [T1566.001] E-mail Spearphishing – Used as a common initial access vector: (‘E-mail Spear phishing (T1566.001) often used to directly engage and/or gain an initial foothold.’)
- [T1190] Exploit Public‑Facing Application – Identified as a frequent entry vector through unpatched edge systems: (‘Exploit Public‑Facing Application (T1190) is another common entry vector…’)
- [T1078] Valid Accounts – Attackers leverage valid credentials (e.g., weak RDP) to gain and maintain access: (‘Using valid accounts (T1078) is and has been a proven method for cybercriminals to gain a foothold.’)
- [T1047] Windows Management Instrumentation (WMIC) – Monitor abnormal WMIC usage as a sign of post‑compromise activity: (‘be on the lookout for abnormal usage of Windows Management Instrumentation WMIC (T1047).’)
Indicators of Compromise
- [Scripts / file names] lateral movement and deployment – obfuscated PowerShell scripts, ransomware binary
- [Domains / leak site] data exposure – public leak website for stolen data (domain referenced by report but not specified in excerpt)
- [Tools / frameworks] detection candidates – Cobalt Strike, winPEAS, and 2 more tools (Lazagne, ADfind/PSExec referenced)
- [APIs / functions] discovery calls – NetShareEnum API used to enumerate shared resources (NetShareEnum)