Cuba Ransomware

The Cuba ransomware is a malicious software that first appeared on cybersecurity radars in late 2020 under the name "Tropical Scorpius." It is designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites without the user's knowledge. Once inside a system, it can steal personal information, disrupt operations, or hold data hostage for ransom. The FBI identified various tactics, techniques, and procedures (TTPs) used by Cuba ransomware actors as of August 2022. However, the exact threat group behind this malware remains unconfirmed, though similarities were observed with the TTPs of the Cuba Ransomware group around that time. In one notable incident, the Cuba ransomware gang claimed responsibility for an attack on Etron Technology, a company based in Taiwan. The stolen data included financial documents and tax information. This cybercriminal group has no relation to the country of Cuba. In another instance, they exploited a bug to target critical infrastructure organizations in the United States and IT firms in Latin America. The group has also been linked to a significant remote code execution (RCE) flaw in Windows Search, tracked as CVE-2023-36884, using geopolitical events such as the Ukrainian World Congress and July 2023 NATO summit as lures. Void Rabisu, another cyber threat group, has been associated with deploying Cuba ransomware, possibly exclusively. They use a mix of TTPs common to both cybercriminals and nation state-sponsored hackers. The group was detected exploiting the aforementioned RCE flaw in June, indicating a shift among some financial-seeking threat actors towards campaigns motivated by espionage due to extraordinary geopolitical circumstances, particularly the war in Ukraine.