Cuba Ransomware !

The US FBI said that the operators of the Cuba ransomware have earned at least $43.9 million from ransom payments following attacks carried out this year.

The Cuba gang has “compromised at least 49 entities in five critical infrastructure sectors, including but not limited to the financial, government, healthcare, manufacturing, and information technology sectors.”

The FBI said it traced attacks with the Cuba ransomware to systems infected with Hancitor, a malware operation that uses phishing emails, Microsoft Exchange vulnerabilities, compromised credentials, or RDP brute-forcing tools to gain access to vulnerable Windows systems.

Once systems are added to their botnet, Hancitor operators rent access to these systems to other criminal gangs in a classic Malware-as-a-Service model.ighlights what appears to be a new partnership between MaaS providers and ransomware gangs after other ransomware operations struck similar partnerships throughout 2020.

The report highlights what appears to be a new partnership between MaaS providers and ransomware gangs after other ransomware operations struck similar partnerships throughout 2020.

Cuba is also one of the ransomware groups that gather and steal sensitive files from compromised entities before encrypting their files. If not payed, the Cuba group will threaten to dump sensitive files on a website they have been operating on the dark web since January this year.

The FBI said that the $43.9 million figure represents actual victim payment and that the group demanded more than $74 million from victims, some of which refused to pay. The figure falls in the usual range of most ransomware revenues reported so far:

• Darkside – $90 million between October 2020 and May 2021.
• Maze/Egregor – $75 million
• Ryuk – $150 million
• REvil – $123 million in 2020
• Netwalker – $25 million between March and July 2020
• Conti – $25.5 million between July and November 2021

Indicators of Compromise

• 141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b69944
• 1d142c36c6cdd393fe543a6b7782f25a9cbafca17a1cfa0f3fc0f5a9431dbf3f
• 81bdd622f0cb9d7e2ac5325a74606fa7818bd4205f37184eba68cdcbe96942f6
• d010fbb1afeb610338c49ae2425b6b7c4a9f4c469aedd096a15b32527565d7db
• 7e765942d89cd3bfaca41034cd959b8d741085bd8bcedbb741e15ed685227a5e
• 05f90cad3627f5253e1a03156793bc6cada7f4ce0d510f55139f0285fcff589d
• EEDC68C92C50BE88C5935651D6B772D4728C3566581BE1F24D4CE7EF63A76D2E
• 3468C6DEB3827F5C161A8622E7D794444C7B38225F6F15002193D2572A4D132E
• 02B17677BEC8A4FBB77FDDB347BFDCC651FF2B25187131CCE45C326E3CF42FE5
• 188E66158E0F96AD1FFD3F090E2570B8644CD80733C7B931E893A4F280165
• ce3a6224dae98fdaa712cfa6495cb72349f333133dbfb339c9e90699cbe4e8e
• b14341b1ffe9e2730394b9066c6829b4e2f59a4234765ae2e97cfc6d4593730a
• 79d6b1b6b1ecb446b0f49772bf4da63fcec6f6bfc7c2e1f4924cb7acbb3b4f53