Officials from the Federal Bureau of Investigation (FBI) say Cuba ransomware operators earned at least $ 43.9 million this year.
In an emergency warning released the other day, the FBI writes that the Cuba group has “compromised at least 49 organizations in five critical infrastructure sectors, including the financial and public sector, healthcare, manufacturing and IT.”
Law enforcement officials say they tracked Cuba’s attacks on systems infected with the Hancitor malware, which uses phishing emails, exploits vulnerabilities in Microsoft Exchange, compromised credentials, or brute-forcing RDP to access vulnerable Windows machines. After Hancitor is infected, access to such a system is leased to other hackers using the Malware-as-a-Service model.
While a McAfee report on Cuba last year found no link between the two groups, the FBI document says that now there appears to be a new partnership between the MaaS vendor and the ransomware. The published FBI document describes how a typical Hancitor-to-Cuba infection occurs and lists indicators of compromise.
Edition of The Record reports that before encrypting data affected Cuba operators kidnapped information and then threatened to publish these files on your site in the darknet if the victim does not pay the ransom. According to data compiled by analysts at Recorded Future, the site has already listed 28 companies that have refused to pay.
The FBI said the $ 43.9 million was just actual payments to the victims, but initially, the hackers demanded more than $ 74 million from the victims, but some refused to pay.
Catch up on more stories here
Follow us on Facebook here