Cuba Ransomware Extorted Over $60 Million in Ransom Fees from More than 100 Entities

The threat actors behind Cuba (aka COLDDRAW) ransomware have
received more than $60 million in ransom payments and compromised
over 100 entities across the world as of August 2022.

In a new advisory shared by the U.S. Cybersecurity and
Infrastructure Security Agency (CISA) and the Federal Bureau of
Investigation (FBI), the agencies highlighted^[1]
a “sharp increase in both the number of compromised U.S. entities
and the ransom amounts.”

The ransomware crew, also known as Tropical Scorpius^[2], has been observed
targeting financial services, government facilities, healthcare,
critical manufacturing, and IT sectors, while simultaneously
expanding its tactics to gain initial access and interact with
breached networks.

The entry point for the attacks involves the exploitation of
known security flaws, phishing, compromised credentials, and
legitimate remote desktop protocol (RDP) tools, followed by
distributing the ransomware via Hancitor^[3]
(aka Chanitor).

Some of the flaws incorporated by Cuba into its toolset are as
follows –

• CVE-2022-24521^[4] (CVSS score: 7.8) – An
  elevation of privilege vulnerability in Windows Common Log File
  System (CLFS) Driver
• CVE-2020-1472^[5] (CVSS score: 10.0) – An
  elevation of privilege vulnerability in Netlogon remote protocol
  (aka ZeroLogon)

“In addition to deploying ransomware, the actors have used
‘double extortion’ techniques, in which they exfiltrate victim
data, and (1) demand a ransom payment to decrypt it and, (2)
threaten to publicly release it if a ransom payment is not made,”
CISA noted.

Cuba is also said to share links with the operators of RomCom
RAT and another ransomware family called Industrial Spy, according
to recent findings from BlackBerry and Palo Alto Networks Unit
42.

The RomCom RAT is distributed^[6]
through trojanized versions of legitimate software such as
SolarWinds Network Performance Monitor, KeePass, PDF Reader Pro,
and Advanced IP Scanner, pdfFiller, and Veeam Backup & Replication
that are hosted on counterfeit lookalike websites.

The advisory from CISA and FBI is the latest in a series of
alerts about different ransomware strains in recent months such as
MedusaLocker^[7], Zeppelin^[8], Vice Society^[9], Daixin Team^[10], and Hive^[11].