[oagitm] FBI FLASH - Indicators of Compromise Associated with Cuba Ransomware - TLP: WHITE
- From: "MASSE THERESA" <dmarc-noreply@xxxxxxxxxxxxx> ("theresa.masse")
- To: "oagitm@xxxxxxxxxxxxx" <oagitm@xxxxxxxxxxxxx>
- Date: Fri, 3 Dec 2021 21:53:45 +0000
FYSA
The FBI has identified, as of early November 2021 that Cuba ransomware actors
have compromised at least 49 entities in five critical infrastructure sectors,
including but not limited to the financial, government, healthcare,
manufacturing, and information technology sectors. Cuba ransomware is
distributed through Hancitor malware, a loader known for dropping or executing
stealers, such as Remote Access Trojans (RATs) and other types of ransomware,
onto victims' networks. Hancitor malware actors use phishing emails, Microsoft
Exchange vulnerabilities, compromised credentials, or legitimate Remote Desktop
Protocol (RDP) tools to gain initial access to a victim's network.
Subsequently, Cuba ransomware actors use legitimate Windows services-such as
PowerShell, PsExec, and other unspecified services-and then leverage Windows
Admin privileges to execute their ransomware and other processes remotely. Cuba
ransomware actors compromise a victim network through the encryption of target
files with the ".cuba" extension. Cuba ransomware actors have demanded at least
US $74 million and received at least US $43.9 million in ransom payments.
The full FLASH has been attached to this email for your reference.
Theresa A. Masse
Cyber Security Advisor, Region 10 (Oregon)
Cybersecurity and Infrastructure Security Agency
Department of Homeland Security
Phone: (503) 930-5671
Email: theresa.masse@xxxxxxxxxxxx<mailto:theresa.masse@xxxxxxxxxxxx>
[cid:image006.png@01D7E84D.2E08BF50]
Other related posts:
- » [oagitm] FBI FLASH - Indicators of Compromise Associated with Cuba Ransomware - TLP: WHITE - MASSE THERESA
