Cuba ransomware
Cuba ransomware is a ransomware group with a financial motive, tracked by Brandefense. It targets 4 sectors, including Manufacturing and Healthcare, in 17 countries, including the United States and the United Kingdom. It uses 35 MITRE ATT&CK techniques and exploits 5 known CVEs.
- Techniques
- 35
- Exploited CVEs
- 5
- First seen
- Dec 28, 2022
- Last seen
- Nov 8, 2023
- Record updated
Who They Target.
About Cuba ransomware.
Cuba ransomware (also tracked as COLDDRAW, Tropical Scorpius, and UNC2596) is a financially motivated ransomware operation active since at least late 2019. FBI and CISA joint advisory AA22-335A (updated January 2023) states there is no indication of a connection to the Republic of Cuba. As of August 2022 the FBI had identified 101 compromises (65 in the United States), about $145 million in ransom demands, and about $60 million paid. Targeted U.S. critical-infrastructure sectors include financial services, government facilities, healthcare and public health, critical manufacturing, and information technology. Initial access has included phishing, compromised credentials, RDP, public-facing exploits, and the Hancitor loader. Later TTPs include CVE- (Windows CLFS), Kerberoasting, KerberCache against LSASS, ZeroLogon (CVE-2020-1472), and a signed ApcHelper.sys driver used to terminate security products. Operators use double extortion; the encryptor appends a.cuba extension and drops a ransom note named!! READ ME!!.txt. Open-source reporting links Cuba actors to RomCom RAT C2 and to selling stolen data on the Industrial Spy marketplace.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.