A ransomware group called Cuba has managed to extort $43.9 million from victims, according to the FBI.
On Friday, the FBI published a warning about the group’s attacks. According to federal investigators, the hackers have compromised at least 49 entities involved in critical infrastructure sectors, including healthcare, manufacturing, IT, government and finance.
The attacks have been arriving through a Windows-based malware program called Hancitor, which has been around since at least 2013 and can download additional malicious programs to a PC. Spam email campaigns are one way Hancitor can be delivered to infect a PC.
“Hancitor malware actors use phishing emails, Microsoft Exchange vulnerabilities, compromised credentials, or legitimate Remote Desktop Protocol (RDP) tools to gain initial access to a victim’s network,” the FBI said in the agency’s alert.
The group will then proceed to manipulate legitimate tools on Windows systems, such as PowerShell and PsExec, to help spread the Cuba ransomware program across a victim’s network. The ransomware will then proceed to encrypt files across a computer with the file extension “.cuba.” To decrypt the files, victims have to pay up in Bitcoin.
“Cuba ransomware actors have demanded at least US $74 million and received at least US $43.9 million in ransom payments,” the FBI said.
In addition, the group will also steal files from a victim’s network and threaten to dump them over a website on the Dark Web unless the ransom is paid, according to the security firm McAfee. “Cuba ransomware has targeted several companies in north and south America as well as in Europe,” McAfee wrote in an April report.
Although the group uses the name Cuba, some security researchers in Israel suspect the ransomware gang is actually based in Russia, a country that refuses to extradite criminal hackers to the US.
The FBI issued the warning as the Biden administration has made stopping ransomware a national security priority. To fight back, the Justice Department is calling on victims to report a ransomware attack to the FBI as soon as possible, otherwise it may be too late for federal investigators to respond.
In regards to the Cuba ransomware group, the FBI said it’s “seeking any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, Bitcoin wallet information, the decryptor file, and/or a benign sample of an encrypted file.”
The agency’s alert also contains tips on how organizations can defend and detect the group’s attacks. They include using multi-factor authentication, strong unique passwords, and keeping all operating systems up-to-date with the latest security patches.