Pierluigi Paganini June 10, 2022

The Cuba ransomware operators are back and employed a new version of its malware in recent attacks.

Cuba ransomware has been active since at least January 2020. Its operators have a data leak site, where they post exfiltrated data from their victims who refused to pay the ransom. The ransomware encrypts files on the targeted systems using the “.cuba” extension.

Cuba ransomware has been actively distributed through the Hancitor malware, a commodity malware that partnered with ransomware gangs to help them gain initial access to target networks. The Hancitor downloader has been active since at least 2016 for dropping Pony and Vawtrak.

A flash alert published by the FBI in December 2021 reported that the Cuba ransomware gang breached the networks of at least 49 US critical infrastructure organizations.

Researchers from Trend Micro have reported a surge in Cuba ransomware gang activity in March and April 2022. The experts reported the use of a new variant in recent attacks, the samples employed in March and April used the BUGHATCH custom downloader.

“Our monitoring showed that the malware authors seem to be pushing some updates to the current binary of a new variant. The samples we examined in March and April used BUGHATCH, a custom downloader that the malicious actor did not employ in previous variants specifically for the staging phase of the infection routine.” reads the analysis published by Trend Micro. “While the updates to Cuba ransomware did not change much in terms of overall functionality, we have reason to believe that the updates aim to optimize its execution, minimize unintended system behavior, and provide technical support to the ransomware victims if they choose to negotiate.”

The new variant is able to terminate a larger number of processes and services, to prevent that applications could lock them and interfere with the encryption process.

Another change in the new variant is related to the expansion of the safelisted directories and file extensions that are not encrypted by the ransomware to preserve the operation of the infected machine.

Another change in the variant used in recent attacks is the addition of quTox to the ransom note, a communication channel to provide technical support to the victims to facilitate ransom payment negotiation.

“We are still investigating the latest set of samples and have yet to establish the entire infection chain for the new Cuba ransomware variant. As mentioned, the indicators that were commonly seen in most of the recent infections were not present in the latest samples we saw.” concludes the report. “Moreover, our detections of new samples in May suggest that Cuba ransomware’s attacks will persist in the coming months, possibly with more updates to the malware that are par for the course.”

Security Affairs is one of the finalists for the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS. I ask you to vote for me again (even if you have already done it), because this vote is for the final.

Please vote for Security Affairs and Pierluigi Paganini in every category that includes them (e.g. sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog”)

To nominate, please visit: 

https://docs.google.com/forms/d/e/1FAIpQLSdNDzjvToMSq36YkIHQWwhma90SR0E9rLndflZ3Cu_gVI2Axw/viewform

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Cuba ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]