Cuba

How Cuba typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via Cuba.

1. T1059.001 PowerShell Execution

   What they do: Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1059.003 Windows Command Shell Execution

   What they do: Cuba has used cmd.exe /c and batch files for execution.

   What that means: Adversaries may abuse the Windows command shell for execution.

3. T1106 Native API Execution

   What they do: Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.

   What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

4. T1543.003 Windows Service PersistencePrivilege Escalation

   What they do: Cuba can modify services by using the OpenService and ChangeServiceConfig functions.

   What that means: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.

5. T1134 Access Token Manipulation Privilege EscalationStealth

   What they do: Cuba has used SeDebugPrivilege and AdjustTokenPrivileges to elevate privileges.

   What that means: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

6. T1027 Obfuscated Files or Information Stealth

   What they do: Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.

   What that means: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

7. T1027.002 Software Packing Stealth

   What they do: Cuba has a packed payload when delivered.

   What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.

8. T1036.005 Match Legitimate Resource Name or Location Stealth

   What they do: Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.

   What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.

9. T1070.004 File Deletion Stealth

   What they do: Cuba can use the command cmd.exe /c del to delete its artifacts from the system.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

10. T1564.003 Hidden Window Stealth

    What they do: Cuba has executed hidden PowerShell windows.

    What that means: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.

11. T1620 Reflective Code Loading Stealth

    What they do: Cuba loaded the payload into memory using PowerShell.

    What that means: Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.

12. T1056.001 Keylogging Credential AccessCollection

    What they do: Cuba logs keystrokes via polling by using GetKeyState and VkKeyScan functions.

    What that means: Adversaries may log user keystrokes to intercept credentials as the user types them.

13. T1007 System Service Discovery Discovery

    What they do: Cuba can query service status using QueryServiceStatusEx function.

    What that means: Adversaries may try to gather information about registered local system services.

14. T1016 System Network Configuration Discovery Discovery

    What they do: Cuba can retrieve the ARP cache from the local system by using GetIpNetTable.

    What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

15. T1049 System Network Connections Discovery Discovery

    What they do: Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.

    What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

16. T1057 Process Discovery Discovery

    What they do: Cuba can enumerate processes running on a victim's machine.

    What that means: Adversaries may attempt to get information about running processes on a system.

17. T1083 File and Directory Discovery Discovery

    What they do: Cuba can enumerate files by using a variety of functions.

    What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

18. T1135 Network Share Discovery Discovery

    What they do: Cuba can discover shared resources using the NetShareEnum API call.

    What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

19. T1614.001 System Language Discovery Discovery

    What they do: Cuba can check if Russian language is installed on the infected machine by using the function GetKeyboardLayoutList.

    What that means: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

20. T1680 Local Storage Discovery Discovery

    What they do: Cuba can enumerate local drives, disk type, and disk free space.

    What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.

21. T1105 Ingress Tool Transfer Command and Control

    What they do: Cuba can download files from its C2 server.

    What that means: Adversaries may transfer tools or other files from an external system into a compromised environment.

22. T1486 Data Encrypted for Impact Impact

    What they do: Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

23. T1489 Service Stop Impact

    What they do: Cuba has a hardcoded list of services and processes to terminate.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

Software Cuba has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

+6 more wallets not shown (the 12 largest by amount received are listed).

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

The note this group leaves on a compromised machine. Click a filename to read it.

Good day. All your files are encrypted. For decryption contact us.
Write here [email protected]
reserve [email protected]
jabber [email protected]
We also inform that your databases, ftp server and file server were downloaded by us to our servers.
If we do not receive a message from you within three days, we regard this as a refusal to negotiate.
Check our platform: http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/
* Do not rename encrypted files.
* Do not try to decrypt your data using third party software,
it may cause permanent data loss.
* Do not stop process of encryption, because partial encryption cannot be decrypted.

Ransom-note text from RansomLook, licensed CC BY 4.0.