Cuba

The Cuba ransomware, a malicious software active since 2019, has been linked to a series of escalating attacks on US entities and European leaders. The criminal group behind the malware, known by various aliases such as Void Rabisu, UNC2596, Tropical Scorpius, and Storm-0978, has recently targeted women leaders within the European Union’s military and political circles. In addition, the number of US entities compromised by the Cuba ransomware has doubled since December 2021, according to federal agencies, with ransoms demanded and paid continually increasing. Notably, the Cuba ransomware gang claimed to have obtained sensitive financial and personal data from Montenegro’s parliament and California's Department of Motor Vehicles. The group is now launching attack campaigns designed to distribute an updated version of the RomCom RAT, named PEAPOD malware. This operation involves Cuba’s signature custom downloader, "BugHatch," which establishes communication with command-and-control (C2) servers to download DLL files or execute commands. Targets include critical infrastructure in the US, such as financial services, government facilities, healthcare and public health, critical manufacturing, and information technology sectors. Meanwhile, communication security in Cuba remains a significant concern. Described as "especially insecure," the SMS system in Cuba reportedly has an automatic system of "sensitive words." Independent journalists and activists have had to rely on private messaging apps like WhatsApp, Telegram, and VPN for secure communication, often playing a cat-and-mouse game with the government to prevent their devices from being seized. However, the Cuban government has found ways to disrupt or block these messages, leading to sudden internet access cuts for critics like journalist Henry Constantin, who works for La Hora de Cuba, a media site not aligned with the communist government.