CUBA
CUBA is a ransomware group with a financial motive, tracked by Brandefense. It targets the Technology and Manufacturing sectors in 3 countries, including the United States and the United Kingdom. It uses 9 MITRE ATT&CK techniques.
- COLDDRAW
- Fidel
- Techniques
- 9
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
About CUBA.
The Cuba Ransomware, also known as Colddraw Ransomware, was first identified in the threat landscape in 2019 and built a relatively small but selected list of victims. The group is also known as Fidel Ransomware, due to a characteristic marker placed at the beginning of all encrypted files. This file marker is used as an indicator for the ransomware and its decoder that the file has been encrypted. Despite its name and the Cuban nationalist style on its leak site, it is difficult to assert any connection or affiliation with the Republic of Cuba. The group has been linked to a Russian-language threat actor by Profero researchers due to some details of incorrect translation they discovered, as well as the discovery of a 404 page containing text in Russian on the threat actor's own leak site. According to BlackBerry, based on the analysis of the code strings used in the campaign analyzed in 2023, there were indications that the developer behind the Cuba ransomware speaks Russian.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.