The FBI has issued a new warning regarding the Cuba ransomware, stating that the gang has targeted "49 entities in five critical infrastructure sectors" and made at least $43.9 million in ransom. The FBI claimed the gang is targeting enterprises in the financial, government, healthcare, manufacturing, and information technology sectors, and is employing the Hancitor malware to gain access to Windows systems, according to an alert sent out on Friday.
The Hancitor malware downloader is used to transmit Cuba ransomware to victims' networks, allowing the ransomware gang to have greater access to previously hacked corporate networks. Hancitor (Chancitor) is a ransomware that distributes data stealers, Remote Access Trojans (RATs), and other ransomware. It was discovered spreading the Vawtrak information-stealing trojan, according to Zscaler. Since then, it has shifted to password-stealers such as Pony and Ficker, as well as Cobalt Strike.
Hancitor employs phishing emails and stolen passwords to get access to their victims' systems, as well as exploiting Microsoft Exchange vulnerabilities and breaking in via Remote Desktop Protocol (RDP) tools. Cuba ransomware operators would exploit legal Windows services (e.g., PowerShell, PsExec, and numerous other unspecified services) to remotely deliver their ransomware payloads and encrypt files with the ".cuba" extension once they have gained access using Hancitor.
When a victim's computer is infected, the ransomware downloads and installs a CobaltStrike beacon, as well as two executable files. Attackers can use the two files to get passwords and "write to the compromised system's temporary (TMP) file."
"Once the TMP file is uploaded, the 'krots.exe' file is deleted, and the TMP file is executed in the compromised network. The TMP file includes Application Programming Interface (API) calls related to memory injection that, once executed, deletes itself from the system. Upon deletion of the TMP file, the compromised network begins communicating with a reported malware repository located at Montenegro-based Uniform Resource Locator (URL) teoresp.com," the FBI explained.
Other assault details were included by the FBI, as well as a sample ransom note and email sent by the attackers. Given their degree of activity in comparison to other more well-known ransomware gangs, experts were startled by the amount of money the group had amassed. The data, according to Emsisoft threat analyst Brett Callow, demonstrated how lucrative the ransomware market is, despite the fact that the Cuba ransomware organization is not among the top ten in terms of activity.
