Ransomwarehigh

Analysis of Cuba ransomware gang activity and tooling

Kaspersky Securelistby @SecurelistSep 11, 2023 · 10:00 UTC (Sep 11, 2023)14 min read1 · 1 read

Read at securelist.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-31207 CVE-2021-34473 CVE-2021-34523 CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065 CVE-2022-26501 CVE-2022-26504 CVE-2022-26500 CVE-2020-1472

Tags: cve-2021-31207 cve-2021-34473 cve-2021-34523 cve-2021-26855 cve-2021-26857 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2020-1472	Unauthenticated Privilege Escalation (Zerologon) in Microsoft Netlogon Domain Controllers	5.5	99%	KEVRansomwarePoC	Aug 17, 2020 KEV Nov 3, 2021
CVE-2021-26855 +3 related CVEs CVE-2021-27065 CVE-2021-26857 CVE-2021-26858	Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)	9.1 group max	100%	KEVRansomwarePoC ×4	Mar 3, 2021 KEV Nov 3, 2021
CVE-2021-31207	Security feature bypass in Microsoft Exchange Server (ProxyShell) enables webshell RCE	6.6	100%	KEVRansomwarePoC	May 11, 2021 KEV Nov 3, 2021
CVE-2021-34473 +1 related CVE CVE-2021-34523	SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell)	9.1 group max	100%	KEVRansomwarePoC	Jul 14, 2021 KEV Nov 3, 2021
CVE-2022-26501 +1 related CVE CVE-2022-26500	Unauthenticated RCE in Veeam Backup & Replication 10.x and 11.x	9.8 group max	4%	KEVRansomware	Mar 17, 2022 KEV Dec 13, 2022
CVE-2022-26504	Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM)…	8.8	3%		Mar 17, 2022

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
domain	test.cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion	ered group’s website is hosted in the Cuba domain: http[:]//test[.]cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd[.]onion/ Website of V IS VENDETTA Cuba remains active as at the

From the original article

14 min read at securelist.com

Knowledge is our best weapon in the fight against cybercrime. An understanding of how various gangs operate and what tools they use helps build competent defenses and investigate incidents. This report takes a close look at the history of the Cuba group, and their attack tactics, techniques and procedures.

Kaspersky Securelist

By @Securelist · securelist.com

Read the full article at Kaspersky Securelist

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.