Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Cuba

The Cuba Ransomware, also known as Colddraw Ransomware, was first identified in the threat landscape in 2019 and built a relatively small but selected list of victims. The group is also known as Fidel Ransomware, due to a characteristic marker placed at the beginning of all encrypted files. This file marker is used as an indicator for the ransomware and its decoder that the file has been encrypted.

Despite its name and the Cuban nationalist style on its leak site, it is difficult to assert any connection or affiliation with the Republic of Cuba. The group has been linked to a Russian-language threat actor by Profero researchers due to some details of incorrect translation they discovered, as well as the discovery of a 404 page containing text in Russian on the threat actor's own leak site.

According to BlackBerry, based on the analysis of the code strings used in the campaign analyzed in 2023, there were indications that the developer behind the Cuba ransomware speaks Russian.

The ransomware operators use a double extortion approach, and following the USA, in August 2022, it was believed that the Cuba ransomware group had compromised 101 entities, demanding $145 million in ransom payments and receiving up to $60 million.

The group used a similar set of TTPs, with only a slight change each year, as they generally consist of LOLBins (executables that are part of the operating system and can be exploited to support an attack), exploits, off-the-shelf and custom malware, as well as intrusion tools like Cobalt Strike and Metasploit.

In 2022, the group allegedly developed a relationship with operators of the Industrial Spy market, using their platform as a means of data leakage.
Source: https://github.com/crocodyli/ThreatActors-TTPs
External information

Victims count: 105

Last discovered victim 2024-02-01

First discovered victims: 2021-02-03


Known Locations
Favicon Title Type Available Last Visit FQDN
favicon None No 2025-01-28 10:00:23 cuba4mp6ximo2zlo.onion
favicon Cuba No 2025-01-28 10:00:47 cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion

Ransom Notes

Tools Used
This information is provided by Ransomware-Tool-Matrix
Discovery RMM Tools Defense Evasion Credential Theft OffSec Networking LOLBAS Exfiltration

NetSupport

Avast Anti-Rootkit driver

Mimikatz

Cobalt Strike

Meterpreter
Termite

PsExec



Vulnerabilities Exploited

No vulnerabilities exploited available.


TTPs Matrix
This information is provided by Crocodyli & Ransomware.live
Initial Access Execution Defense Evasion Discovery Lateral Movement Credential Access Command and Control
External Remote Services Native API Masquerading: Match Legitimate Name or Location Time Discovery Tool Transfer Exploitation for Credential Access Remote Desktop Protocol
Valid Accounts: Local Accounts User Execution: Malicious File Exploitation for Privilege Escalation Network Share Discovery External Remote Services Remote Services: External Remote Services Multi-hop Proxy
  Command and Scripting Interpreter: PowerShell   Remote System Discovery     Application Layer Protocol: DNS
  Command and Scripting Interpreter: Windows Command Shell   File and Directory Discovery     Application Layer Protocol: Web Protocols
  System Services: Service Execution   Process Discovery      
      Network Configuration Discovery: Network Connection Enumeration      

Negotiation Chats

No negotiation chats available.


YARA Rules

No YARA rules available.


Victims (105)
Logo
dms-imaging cuba
📅 Discovery Date: 2024-02-01
DMS is a French industrial company specialized in digital radiology, with an international reach, an...
FR
Logo
deknudtframes.be cuba
📅 Discovery Date: 2024-01-22
⚠️ Estimated Attack Date: 2024-01-18
Our teamOur team in Deerlijk consists of enthusiastic and motivated people with passion for their pr...
BE
Logo
diagnostechs cuba
📅 Discovery Date: 2023-11-14
HistoryEstablished in 1987, DiagnosTechs was the first laboratory to introduce saliva hormone testin...
Logo
portadelaidefc cuba
📅 Discovery Date: 2023-11-13
PORT ADELAIDE is renowned for setting the bar high and expecting success, and the club’s latest stra...
Logo
panaya cuba
📅 Discovery Date: 2023-11-07
About PANAYAPanaya’s Change Intelligence solutions reduce the time, cost, and risk involved in chang...
Logo
prime-art cuba
📅 Discovery Date: 2023-11-07
For PAJ, your success is our success.Jewelry making is an art and a science. We are constantly impro...
Logo
Newconcepttech cuba
📅 Discovery Date: 2023-10-23
FROM A SINGLE START-UP TO A MULTI-MILLION DOLLAR COMPANYOur prosperity is due to three interlocking ...
Logo
mountstmarys cuba
📅 Discovery Date: 2023-10-10
Mount St Mary’s is rightly proud of its extensive heritage dating back over 160 years. The original ...
Logo
co.rock.wi.us cuba
📅 Discovery Date: 2023-10-03
Rock County Public Health DepartmentThe Rock County Public Health Department (RCPHD) is a level III ...
US
Logo
goldmedalbakery cuba
📅 Discovery Date: 2023-08-19
Gold Medal Bakery aspires to follow three core values in every aspect of its business.Integrity: Gol...
Logo
hydrex.co.uk cuba
📅 Discovery Date: 2023-07-31
Established in 1985, with 13 depots and one support centre nationwide, Hydrex is one of the largest ...
GB
Logo
txmplant.co.uk cuba
📅 Discovery Date: 2023-07-31
At TXM Plant we know that the services we provide are critical to the success of our customers’ proj...
GB
Logo
gis4.addison-il cuba
📅 Discovery Date: 2023-07-11
More than 36,000 people call the Village of Addison home.  Whether you are new to our community, or ...
Logo
Inquirer cuba
📅 Discovery Date: 2023-05-23
About The Philadelphia Inquirer, PBCSince 1829, The Philadelphia Inquirer has been “asking on behalf...
Logo
Vdi cuba
📅 Discovery Date: 2023-05-10
Užtikrindami oruma darbe mes užtikriname ir pamatines žmogaus teisesValstybines darbo inspekcijos (V...
Logo
Gihealthcare cuba
📅 Discovery Date: 2023-05-04
Your health is our top priority. We specialize in digestive system care and will guide you through e...
Logo
pu.edu.lb cuba
📅 Discovery Date: 2022-12-27
Phoenicia University (PU) is a non-profit, private, and nonsectarian officially licensed institution...
Logo
Sae-a cuba
📅 Discovery Date: 2022-12-20
From yarn-production through its fabric mills that draw on in new innovation and technology, to reta...
Logo
2networkit cuba
📅 Discovery Date: 2022-12-12
N/A
Logo
Landaumedia cuba
📅 Discovery Date: 2022-12-01
N/A
Logo
Generator-power cuba
📅 Discovery Date: 2022-12-01
N/A
Logo
Boss-inc cuba
📅 Discovery Date: 2022-12-01
N/A
Logo
Patton cuba
📅 Discovery Date: 2022-11-30
N/A
Logo
Pmc-group cuba
📅 Discovery Date: 2022-11-24
N/A
Logo
waltersandwolf cuba
📅 Discovery Date: 2022-11-09
N/A
Logo
bfw cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
Ville-chaville cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
Murphyfamilyventures cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
Ginspectionservices cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
Dialogsas cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
usairports cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
trant.co.uk cuba
📅 Discovery Date: 2022-11-04
N/A
GB
Logo
the_rose_executive_team cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
technicote cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
stm.com.tw cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
site-technology_ cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
schultheis-ins cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
quercus cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
otrcapital cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
ohagin cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
nwdusa cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
ncmutuallife2 cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
meriplex cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
megaforce cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
lycra cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
linkmfg cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
learning_resources cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
landofrost cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
innovairre cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
get-integrated cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
gascaribe cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
forefront_dermatology cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
first_coast_logistics_services cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
e.h._wachs_pipe_cutters cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
datamatics cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
creditriskmonitor cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
blackhawk cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
berding-weil cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
bcintlgroup.com cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
axley cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
afts cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
Skupstina cuba
📅 Discovery Date: 2022-11-04
N/A
Logo
ginspectionservices cuba
📅 Discovery Date: 2022-09-27
N/A
Logo
skupstina cuba
📅 Discovery Date: 2022-08-30
N/A
Logo
site-technology cuba
📅 Discovery Date: 2022-07-21
N/A
Logo
stm-com-tw cuba
📅 Discovery Date: 2022-07-07
N/A
Logo
r1group cuba
📅 Discovery Date: 2022-06-27
N/A
Logo
etron cuba
📅 Discovery Date: 2022-06-13
N/A
Logo
upskwt cuba
📅 Discovery Date: 2022-05-17
N/A
Logo
fronteousa cuba
📅 Discovery Date: 2022-05-16
N/A
Logo
prophoenix cuba
📅 Discovery Date: 2022-04-22
N/A
Logo
metrobrokers cuba
📅 Discovery Date: 2022-04-22
N/A
Logo
tavistock cuba
📅 Discovery Date: 2022-04-12
N/A
Logo
metagenics cuba
📅 Discovery Date: 2022-04-08
N/A
Logo
bcintlgroup-com cuba
📅 Discovery Date: 2022-03-30
N/A
Logo
trant-co-uk cuba
📅 Discovery Date: 2022-03-30
N/A
Logo
haltonhills cuba
📅 Discovery Date: 2022-03-23
N/A
Logo
powertech cuba
📅 Discovery Date: 2022-03-23
N/A
Logo
ids97 cuba
📅 Discovery Date: 2022-02-25
N/A
Logo
muntons cuba
📅 Discovery Date: 2022-02-18
N/A
Logo
heritage-encon cuba
📅 Discovery Date: 2022-02-18
N/A
Logo
shoesforcrews cuba
📅 Discovery Date: 2022-02-04
N/A
Logo
edgo cuba
📅 Discovery Date: 2022-02-04
N/A
Logo
cmmcpas cuba
📅 Discovery Date: 2022-02-04
N/A
Logo
mtlcraft cuba
📅 Discovery Date: 2022-01-25
N/A
Logo
superfund cuba
📅 Discovery Date: 2022-01-13
N/A
Logo
fdcbuilding cuba
📅 Discovery Date: 2022-01-13
N/A
Logo
strongwell cuba
📅 Discovery Date: 2022-01-10
N/A
Logo
sonomatic-2 cuba
📅 Discovery Date: 2022-01-10
N/A
Logo
regulvar cuba
📅 Discovery Date: 2022-01-10
N/A
Logo
delinebox cuba
📅 Discovery Date: 2022-01-10
N/A
Logo
cle cuba
📅 Discovery Date: 2022-01-10
N/A
Logo
squamish cuba
📅 Discovery Date: 2021-12-30
N/A
Logo
sonomatic cuba
📅 Discovery Date: 2021-12-30
N/A
Logo
ncmutuallife cuba
📅 Discovery Date: 2021-12-30
N/A
Logo
lahebert cuba
📅 Discovery Date: 2021-12-30
N/A
Logo
bakertilly cuba
📅 Discovery Date: 2021-12-30
N/A
Logo
atlasdie cuba
📅 Discovery Date: 2021-12-30
N/A
Logo
Rose Associates Mission Statement cuba
📅 Discovery Date: 2021-09-09
N/A