Skip to content
Threat actors by targeted country

Threat Actors Targeting Cuba.

Brandefense tracks 8 threat actors known to target Cuba. The most documented are GhostEmperor, RansomHub and Cuba ransomware. The sectors they target most are Defense and Aerospace, Finance, and Government.

8 of 8 published profiles shown

GhostEmperorChina
aka FamousSparrow · Earth Estrie · UNC2286 +4
Nation-state APTEspionage

GhostEmperor is a China-attributed nation-state APT group with an espionage motive.

140TTPs
47exploited
67malware
StrategicProfile →
RansomHub
aka RansomHub Team · RansomHub Ransomware · Water Bakunawa
RansomwareFinancial

RansomHub is a ransomware group with a financial motive.

111TTPs
30exploited
72malware
AdvancedProfile →
Cuba ransomware
RansomwareFinancial

Cuba ransomware is a ransomware group with a financial motive.

35TTPs
5exploited
10malware
AdvancedProfile →
TGR-STA-1030China
aka UNC6619
UnclassifiedIdeology

TGR-STA-1030 is a China-attributed threat actor group with an ideological motive. It targets organisations in 14 countries, including India and France.

20TTPs
–No CVE data
23malware
AdvancedProfile →
Machete
aka APT-C-43 · El Machete · TEMP.Andromeda +4
Nation-state APTEspionage

Machete is a nation-state APT group with an espionage motive.

18TTPs
–No CVE data
4malware
AdvancedProfile →
Chinese State-Sponsored APTsChina
UnclassifiedIdeology

Chinese State-Sponsored APTs is a China-attributed threat actor group with an ideological motive.

8TTPs
–No CVE data
5malware
AdvancedProfile →
UNK_ColtCenturyChina
aka TAG-100 · Storm-2077 · RedNovember
UnclassifiedIdeology

UNK_ColtCentury is a China-attributed threat actor group with an ideological motive.

3TTPs
–No CVE data
15malware
AdvancedProfile →
StormouS-X
aka Stormous · stormous Team · STMX +1
RansomwareFinancial

StormouS-X is a ransomware group with a financial motive.

1TTPs
–No CVE data
1malware
InnovatorProfile →
On the Brandefense platform

IOC Feeds, YARA Rules And ATT&CK Navigator Exports For Every Actor.

Plus alerts when an actor in your sector starts exploiting a product you run, and detection rules you can load into your own tools.

Request A Demo

FAQ

Common Questions.