Free tools Windows power users keep installed
One-click scans. No signup required.
The FBI and CISA described Cuba ransomware activity in a joint advisory released December 1, 2022, and updated December 12, 2022. The warning covers attacks and FBI figures reported through August 2022—not a new 2026 alert. It identifies five U.S. critical infrastructure sectors targeted, explains how intrusions and double extortion worked, and recommends layered defenses including protected backups, phishing-resistant MFA, patching, segmentation, and monitoring.
What the FBI and CISA warned about
The joint advisory, AA22-335A, shares indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with Cuba ransomware actors identified through FBI investigations, third-party reporting, and open-source reporting. It updated an FBI flash issued in December 2021. CISA recorded the advisory update on December 13, 2022, after additional IOCs were added on December 12, 2022; see its update notice.
The name does not establish a connection to the country. FBI and CISA wrote: “While this ransomware is known by industry as ‘Cuba ransomware,’ there is no indication Cuba ransomware actors have any connection or affiliation with the Republic of Cuba.”
Five U.S. sectors named
The advisory describes FBI-observed targeting of U.S. entities in these critical infrastructure sectors:
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- Financial Services
- Government Facilities
- Healthcare and Public Health
- Critical Manufacturing
- Information Technology
Figures are a snapshot through August 2022
As of August 2022, the FBI had identified 101 compromised entities: 65 in the United States and 36 outside the United States. The actors had demanded $145 million and received $60 million in ransom payments. These are FBI figures reported in the 2022 advisory, not current totals.
How the reported attacks worked
The advisory describes several possible initial-access routes rather than one fixed entry point. These included known vulnerabilities in commercial software, phishing campaigns, compromised credentials, and legitimate remote desktop protocol (RDP) tools. It says the actors distributed Cuba ransomware through Hancitor, a loader known for dropping or executing information stealers, remote-access trojans, and other ransomware.
Rank #2
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Privilege escalation and movement through networks
After gaining access, actors used techniques and tools to escalate privileges and move through compromised environments. The advisory reports exploitation of CVE-2022-24521 in the Windows Common Log File System driver to steal system tokens and elevate privileges. It also describes Kerberoasting against service accounts and use of KerberCache to extract cached Kerberos tickets from LSASS memory. A tool exploiting CVE-2020-1472, also known as ZeroLogon, was used to gain domain administrator privileges.
Some of the technical details were attributed to Palo Alto Networks Unit 42. The advisory characterizes a Cuba, RomCom, and Industrial Spy association as an apparent or possible link based on third-party and open-source reporting; it should not be treated as a conclusively established relationship.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #3
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
Security tools and double extortion
The advisory says a dropper wrote the ApcHelper.sys kernel driver, which targeted and terminated security products. It also describes double extortion: actors stole data as well as encrypting it, demanded payment for decryption, and threatened to publish the stolen data if the victim did not pay.
What organizations should do to reduce risk
The advisory’s “actions to take today” emphasize remediating known exploited vulnerabilities, teaching users to recognize and report phishing, and enforcing phishing-resistant MFA. Its broader mitigations combine recovery planning and layered prevention, detection, and containment rather than relying on a single security product.
Rank #4
- SonicWall Advanced Protection Service Suite for NSA3700 - 3 Year License (02-SSC-6910)
- Capture ATP with RTDMI for Enterprise: Defend against zero-day exploits and ransomware using multi-engine cloud sandboxing and advanced memory inspection.
- Full Threat Protection Stack: Includes Gateway AV, Intrusion Prevention, Anti-Spyware, Application Control, and Content Filtering for layered defense.
- 24x7 Global Support & Firmware Updates: Keep your firewall protected and operational with continuous technical assistance and critical firmware upgrades.
- Application Intelligence & Network Control: Identify and control network activity with deep traffic analytics and reporting features.
Prepare recovery copies that attackers cannot easily reach
- Maintain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location. The advisory gives a hard drive, storage device, or cloud storage as examples; an external drive alone is not an enterprise recovery plan.
- Plan how to restore systems and data, and protect backup copies so an attacker who reaches the production network cannot readily alter or encrypt them.
Close common access routes
- Enable MFA wherever possible, especially for webmail, VPNs, and accounts with access to critical systems. Prefer phishing-resistant MFA.
- Keep operating systems, software, and firmware current. Prioritize known exploited vulnerabilities and internet-facing systems.
- Use sound password practices, particularly for accounts that could enable access to sensitive systems or lateral movement.
- Train users to recognize and report phishing attempts.
Limit movement and detect suspicious activity
- Segment networks to restrict lateral movement between systems and environments.
- Log and monitor network traffic for abnormal activity.
- Deploy endpoint detection and response (EDR) to help detect lateral connections.
- Enable real-time antivirus on hosts and keep it regularly updated.
How to use the advisory’s indicators
AA22-335A’s IOCs and technical observations belong to a historical 2022 threat picture. They can inform defensive context, but should not be treated as a complete or current list for 2026 detection. Before using those indicators for active threat hunting or incident decisions, verify them against current authoritative threat intelligence and your organization’s telemetry.
The advisory is not evidence of the group’s present activity level. The FBI’s Cyber Alerts index is one place to check for official alerts, but the absence of a newer Cuba-specific item there would not prove that no later incidents or reporting exist.
Best Value
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
If ransomware affects your organization
The FBI’s general ransomware guidance does not support paying a ransom: payment does not guarantee recovery and may incentivize further victimization. The Bureau directs victims to contact a local FBI field office or report the incident through IC3. This is general FBI victim guidance, distinct from the 2022 Cuba-specific advisory.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
