Cuba

ATP Sandbox Adv. HeuristicsAV

Description

Cuba is a Windows based ransomware family used against financial institutions, technology, and logistics organizations in North and South America as well as Europe since at least December 2019.

Stats

First seen: February 2022
Last seen: October 2026

MITRE ATT&CK techniques

23 techniques across 7 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1059.001PowerShell
T1106Native API

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
T1027Obfuscated Files or Information
- T1027.002Software Packing
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1070Indicator Removal
- T1070.004File Deletion
T1134Access Token Manipulation
T1564Hide Artifacts
- T1564.003Hidden Window
T1620Reflective Code Loading

TA0007 Discovery

T1007System Service Discovery
T1016System Network Configuration Discovery
T1049System Network Connections Discovery
T1057Process Discovery
T1083File and Directory Discovery
T1135Network Share Discovery
T1614System Location Discovery
- T1614.001System Language Discovery
T1680Local Storage Discovery

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging

TA0011 Command and Control

T1105Ingress Tool Transfer

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop

Alert name variants

Alert Name	Engine
DeepScan:Generic.Ransom.Cuba.097204E7	AV
DeepScan:Generic.Ransom.Cuba.4D0E95B0	AV
DeepScan:Generic.Ransom.Cuba.52466964	AV
DeepScan:Generic.Ransom.Cuba.D265BE39	AV
Dump:Generic.Ransom.Cuba.C32CFE13	AV
Gen:Variant.Ransom.Cuba.3	AV
Generic.Ransom.Cuba.097204E7	AV
Generic.Ransom.Cuba.11D2667D	AV
Generic.Ransom.Cuba.21BEDDA8	AV
Generic.Ransom.Cuba.D265BE39	AV
Trojan.Ransom.Cuba.A	AV
Win32.Ransomware.Cuba	ATP Sandbox Adv. Heuristics

Related blogs

Threat Labs News Roundup: May 2023

June 9, 20234 min read

Threat Labs News Roundup: January 2023

February 16, 20234 min read

Related families

PlugX InvisiMole Qilin Cobalt Strike KONNI

References