{"id":6491,"date":"2022-12-06T22:37:47","date_gmt":"2022-12-06T22:37:47","guid":{"rendered":"https:\/\/sajinshivdas.com\/security\/?p=6491"},"modified":"2023-03-27T08:30:50","modified_gmt":"2023-03-27T08:30:50","slug":"cuban-ransomware","status":"publish","type":"post","link":"https:\/\/sajinshivdas.com\/cybersecurity\/cuban-ransomware\/","title":{"rendered":"More than a hundred Cuban organizations paid over $60 million in ransom to cybercriminals after they were hit by ransomware."},"content":{"rendered":"[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_column_text]\n

As of August 2022, the cybercriminals behind the Cuba (also known as COLDDRAW) ransomware had collected over $60 million in extortion payments from over 100 victims around the world.<\/p>\n

The Federal Bureau of Investigation and the United States Cybersecurity and Infrastructure Security Agency (CISA) have issued a joint alert in which they note<\/a> a “sharp spike in both the number of compromised U.S. companies and the ransom amounts.”<\/p>\n

The ransomware group known as Tropical Scorpius has been detected increasing its strategies to acquire initial access and interact with infiltrated networks, while simultaneously targeting financial services, government facilities, healthcare, vital industrial, and IT.<\/p>\n

It should be noted that there is no proof that the actors have any link or affiliation with the island nation of Cuba, despite the title.<\/p>\n

Hancitor is used for ransomware distribution once attackers gain access through a variety of methods, including but not limited to: phishing, compromised credentials, and legitimate remote desktop protocol (RDP) applications (aka Chanitor).<\/p>\n

Cuba has included a number of shortcomings into its arsenal, including the following:<\/p>\n