Cuba
Cuba ransomware is a financially motivated ransomware and extortion malware family, active since at least early 2020 and publicly noted as launching in December 2020. It is associated with the Cuba Ransomware group, which has targeted retailers and manufacturers in North America and Europe, including small and medium-sized organizations, and uses double-extortion or “name and shame” tactics by exfiltrating sensitive data before encryption. Reporting cited in the content also notes assessments that the intrusion set has at times shown espionage-related motivations in addition to opportunistic, profit-driven activity.
Observed capabilities include encrypting system data and appending the .cuba extension to encrypted files; querying service status via QueryServiceStatusEx; checking whether Russian language is installed using GetKeyboardLayoutList; using SeDebugPrivilege and AdjustTokenPrivileges for privilege escalation; logging keystrokes via GetKeyState and VkKeyScan; loading payloads into memory with PowerShell; executing hidden PowerShell windows; deleting artifacts with cmd.exe /c del; and arriving with a packed payload. The malware has also been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.
In intrusion activity linked to Cuba ransomware, operators have used obfuscated PowerShell scripts for staging and lateral movement, and PowerShell stagers to download additional tooling. Elastic-linked activity describes likely exploitation of Microsoft Exchange vulnerabilities such as ProxyLogon and ProxyShell, followed by persistence through creation of a hidden local user and enabling RDP. Associated tooling in those intrusions included Meterpreter, Mimikatz, PsExec, SystemBC, Cobalt Strike, NetSupport Manager, GoToAssist, DefenderControl, and the BUGHATCH downloader. The actors were also observed attempting Zerologon-based privilege escalation.
Multiple reports in the content link Cuba ransomware operations to BURNTCIGAR/KApcHelper-style tooling used to disable endpoint security prior to ransomware deployment. Sophos assessed with high confidence that a loader variant of BURNTCIGAR and related signed drivers were tied to Cuba ransomware based on technical overlaps and prior reporting. Those components used the symbolic link \.\KApcHelperLink1 and IOCTLs including 0x222094 to terminate security processes from a list of 186 targeted process names.
The content also notes that Cuba operators have been observed exploiting Veeam Backup & Replication vulnerabilities, and that industry analysts assessed the ransomware likely did not originate from Cuba despite its name.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Elastic Security Team is tracking an organized and financially-motivated ransomware and extortion group called Cuba Ransomware... deploying ransomware... uses a “name and shame” approach
Elastic Security Team is tracking an organized and financially-motivated ransomware and extortion group called Cuba Ransomware... deploying ransomware... uses a “name and shame” approach
"The most severe of the problems addressed is CVE-2024-40711, a critical (CVSS v3.1 score: 9.8) remote code execution (RCE) vulnerability on Veeam Backup & Replication (VBR) that can be exploited without authentication."
Next the threat actors attempted to use a file called zero.exe, which is used to exploit the Zerologon vulnerability to escalate privileges.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Prior research indicate that threat actors who used this tool in prior attacks later attempted to deploy ransomware that calls itself Cuba. ... Our incident and the incident from PAN’s report are both linked to Cuba ransomware, with high confidence.
Elastic Security Team is tracking an organized and financially-motivated ransomware and extortion group called Cuba Ransomware... deploying ransomware... uses a “name and shame” approach
"Their ransomware arsenal evolved over time: Cuba ransomware (early 2020)..."
Techniques & procedures
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique“We observed the execution of the ProxyLogon exploit… leveraging ProxyLogon and ProxyShell vulnerabilities to gain initial access… exploitation of publicly accessible Exchange servers initiated the compromise.”
Execution
2 techniquesThe content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions. | APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution. Blue Mockingbird has used batch script files to automate execution and deployment of payloads. During HomeLand Justice, threat actors used Windows batch files for persistence and execution.
Persistence
1 technique“Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer… replaced the ImagePath registry value of a Windows service with a new backdoor binary… [multiple groups/malware] creating a service / installing as a service / modifying service configurations for persistence.”
Privilege Escalation
2 techniques“Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer… replaced the ImagePath registry value of a Windows service with a new backdoor binary… [multiple groups/malware] creating a service / installing as a service / modifying service configurations for persistence.”
Stealth
10 techniquesThe content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
"Sandworm Team used UPX to pack a copy of Mimikatz"; "APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium"; "Lazarus Group packed malicious .db files with Themida to evade detection."
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Bad Rabbit has masqueraded as a Flash Player installer through the executable file install_flash_player.exe.
Examples throughout the content include deleting tools, logs, malware-related files, staged archives, screenshots, temporary files, and exfiltrated data 'to cover their tracks,' 'reduce their footprint,' 'remove traces of activity,' or as part of 'post-intrusion cleanup.'
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
Multiple actors and malware are described as concealing execution by spawning PowerShell/console windows with parameters like "-WindowStyle Hidden" / "-W Hidden" / "ProcessWindowStyle.Hidden" or via APIs such as ShowWindow, CreateNoWindow, and CREATE_NO_WINDOW.
"Brute Ratel C4 has used reflective loading to execute malicious DLLs." / "Cobalt Strike's execute-assembly command can run a .NET executable within the memory of a sacrificial process..." / "FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory."
Credential Access
1 techniqueDiscovery
9 techniques"actors used the following command ... to obtain information about services: net start"; "APT1 used the commands net start and tasklist to get a listing of the services on the system"; "OilRig has used sc query on a victim to gather information about services"; "Indrik Spider has used the win32_service WMI class to retrieve a list of services"
The content repeatedly describes actors and malware using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, netsh interface show, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, and network adapter/interface details.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
"4H RAT sends an OS version identifier in its beacons"; "admin@338 actors used ... ver ... systeminfo"; "Bundlore will enumerate the macOS version ... using /usr/bin/sw_vers -productVersion"; "DarkTortilla ... querying ... WMI objects"; "Turla ... discover operating system configuration details using the systeminfo and set commands"
“3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory… admin@338 actors used… dir c:\ >> %temp%\download … APT28 has used Forfiles to locate PDF, Excel, and Word documents…”
"Babuk can enumerate disk volumes, get disk information"; "Ryuk has called GetLogicalDrives ... and GetDriveTypeW"; "Cuba can enumerate local drives, disk type, and disk free space"; "Chimera ... fsutil fsinfo drives"
"Emotet ... WNetEnumResourceW to enumerate non-hidden shares"; "Cuba ... discovery like GetIpNetTable and NetShareEnum"; "Clop ... WNetOpenEnumW(), WNetEnumResourceW()"
Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities... Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian... Clop has checked the keyboard language using the GetKeyboardLayout() function... Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage.
Lateral Movement
1 technique"During the 2022 Ukraine Electric Power Attack, Sandworm Team utilized a PowerShell utility called TANKTRAP to spread and launch a wiper using Windows Group Policy," and "Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts."
Collection
1 techniqueImpact
2 techniquesIOCs tracked for this family
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named ransomware family mentioned only to clarify that, despite its name, it likely did not originate from Cuba.
Ransomware family/gang linked to attacks targeting Veeam Backup & Replication (VBR) vulnerabilities.
A ransomware family associated with RomCom operations via shared infrastructure/payload delivery and used for double-extortion attacks.
Ransomware linked (via its operators) to exploitation of Veeam Backup & Replication vulnerabilities for attack operations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.