CISA Alert AA22-335A – #StopRansomware: Cuba Ransomware

This is a CISA Cybersecurity Alert. ID number Alpha Alpha Two Two tack Three Three Five Alpha.

Last revised- December Fifth, twenty twenty two.

CISA and FBI are releasing this joint advisory to disseminate known Cuba ransomware IOCs and TTPs associated with Cuba ransomware actors identified through FBI investigations, third-party reporting, and open-source reporting. This advisory updates the December 2021 FBI Flash: Indicators of Compromise Associated with Cuba Ransomware.

While this ransomware is known by industry as Cuba Ransomware, there is no indication Cuba ransomware actors have any connection or affiliation with the Republic of Cuba.

Since the release of the December 2021 FBI Flash, the number of U.S. entities compromised by Cuba ransomware has doubled. As of August 2022, FBI has identified that Cuba ransomware actors have compromised over 100 entities worldwide and demanded over 145 million US Dollars and received over 60 million US Dollars in ransom payments.

This year, Cuba ransomware actors have added to their TTPs, and third-party and open-source reports have identified a possible link between Cuba ransomware actors, RomCom Remote Access Trojan actors, and Industrial Spy ransomware actors.

FBI and CISA encourage organizations to implement the recommendations in the Mitigations section of this alert to reduce the likelihood and impact of Cuba ransomware and other ransomware operations.

The alert documentation linked in the show notes includes known exploited vulnerabilities, indicators of compromise, TTPs, and mitigation actions. Victims of ransomware operations should report the incident to their local FBI field office or CISA.

To report incidents and anomalous activity or to request incident response resources or technical assistance, contact CISA at report@cisa.gov, or call (888) 282-0870, or report incidents to your local FBI field office.

This report was written by CISA, the United States Cybersecurity and Infrastructure Security Agency, and edited and adapted for audio by the CyberWire as a public service. Please visit www dot cisa dot gov to read the full report which may include additional details, links, and illustrations. A link to this report can be found in the show notes.

This has been a CISA Cybersecurity Alert.