iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
FBI and CISA reported that Cuba ransomware actors had compromised 101 entities by August 2022: 65 in the United States and 36 elsewhere. The agencies’ joint advisory also recorded $145 million in ransom demands and $60 million received. These are historical figures, not a current cumulative count. The name “Cuba ransomware” does not indicate a connection to the Republic of Cuba; the agencies said they had no indication of such an affiliation.
How many organizations did Cuba ransomware hit?
The FBI and CISA’s joint advisory AA22-335A reported 101 entities compromised as of August 2022, comprising 65 in the United States and 36 outside the country. The advisory was issued December 1, 2022, and updated December 12, 2022. Its totals describe the snapshot available at that time, not the number of victims in later years. Read the FBI and CISA advisory.
In February 2023, the Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center (HC3) summarized the operators as having compromised more than 100 targets. That retrospective restates the advisory’s findings; it is not a separate or current victim count. Read the HHS HC3 retrospective.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHow much money did Cuba ransomware demand?
In the same August 2022 snapshot, the FBI reported $145 million in ransom demands and $60 million in payments received. These figures are the totals stated in the advisory; they should not be read as amounts demanded or paid since then.
What sectors did Cuba ransomware target?
The FBI listed victims in five U.S. critical-infrastructure sectors:
- Financial services
- Government facilities
- Healthcare and public health
- Critical manufacturing
- Information technology
The advisory’s list describes the sectors represented among the reported U.S. victims. It does not establish that every organization in those sectors was targeted.
Rank #2
How did the reported attacks work?
AA22-335A combines information from FBI investigations, third-party reporting, and open-source reporting. It describes techniques associated with the actors; it does not say every intrusion used every technique. Those observations are from the 2022 advisory and should not be treated as a current list of indicators or tactics.
Initial access
Reported entry methods included exploiting known software vulnerabilities, phishing, using compromised credentials, and legitimate Remote Desktop Protocol (RDP) tools. The advisory also says Hancitor was used to distribute Cuba ransomware on compromised systems.
Rank #3
Credential access and evasion
The agencies described privilege escalation and credential-access activity that included exploiting Windows vulnerabilities, Kerberoasting, and extracting cached Kerberos tickets. The advisory also recounts reporting that a dropper deployed a kernel driver to target and terminate security products.
Data theft and extortion
The advisory describes double extortion: attackers stole victim data, demanded payment for a decryption key, and threatened to publish the stolen information if the victim did not pay. It also notes possible relationships among Cuba ransomware actors, RomCom RAT actors, and Industrial Spy activity. Those links were based on third-party and open-source reporting and were presented as possible, not conclusively established.
What does “Cuba ransomware” mean?
“Cuba ransomware” is the name used for the ransomware operation; the FBI and CISA said they had no indication that its actors were affiliated with the Republic of Cuba. The advisory does not establish a national connection from the name alone.
Recommended Free Tools
How can organizations protect against ransomware?
FBI and CISA recommend treating recovery as part of security planning rather than relying on a single backup device. Their advisory calls for multiple copies of sensitive or proprietary data and servers in physically separate, segmented, secure locations. It names hard drives, storage devices, and cloud storage as possible media or locations; it does not rank them or endorse a particular product.
Best Value
- Plan for recoverability: Keep multiple backup copies, separated from production systems and protected from unauthorized access. Include the copies in a recovery plan.
- Remediate known exploited vulnerabilities: Prioritize fixing vulnerabilities known to be exploited, especially on systems exposed to the internet.
- Strengthen account security: Follow password practices aligned with NIST guidance and enable phishing-resistant multifactor authentication.
- Train users: Help staff recognize phishing and provide a clear way to report suspicious messages.
An external hard drive can be one medium for an offline recovery copy, but a drive alone is not a ransomware defense. The agencies’ recommendation is for multiple, securely separated copies as part of a broader recovery plan.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
