A ransomware group from Cuba has hit “49 entities in five critical infrastructure sectors” in the US and made at least $43.9 million in ransom payments.
In a notice, the Federal Bureau of Investigation (FBI) said that the group is targeting enterprises in the financial, government, healthcare, manufacturing, and information technology sectors.
“The FBI has identified, as of early November 2021, that Cuba ransomware actors have compromised at least 49 entities in five critical infrastructure sectors, including but not limited to the financial, government, healthcare, manufacturing and information technology sectors,” the notice said on Friday.
Cuba ransomware is distributed through Hancitor malware, a loader known for dropping or executing stealers, such as Remote Access Trojans (RATs) and other types of ransomware, onto the victims’ networks.
Hancitor malware actors use phishing emails, Microsoft Exchange vulnerabilities, compromised credentials, or legitimate Remote Desktop Protocol (RDP) tools to gain initial access to a victim’s network.
Cuba ransomware actors have demanded at least $74 million and received at least $43.9 million in ransom payments.
