{"id":71450,"date":"2022-12-05T03:43:00","date_gmt":"2022-12-05T08:43:00","guid":{"rendered":"http:\/\/blog.cybercon1.com\/?p=71450"},"modified":"2023-03-07T16:43:18","modified_gmt":"2023-03-07T21:43:18","slug":"cuba-ransomware-infections-of-us-organizations-have-doubled-in-last-year","status":"publish","type":"post","link":"https:\/\/blog.cyberconservices.com\/index.php\/2022\/12\/05\/cuba-ransomware-infections-of-us-organizations-have-doubled-in-last-year\/","title":{"rendered":"Cuba ransomware infections of US organizations have doubled in last year"},"content":{"rendered":"\n

Derek B. Johnson<\/a> – The Cuba ransomware<\/strong> group has doubled its number of American victims over the past year, infecting at least 65 U.S. entities across a broad range of critical infrastructure sectors and stealing more than $60 million in ransom payment through August 2022, according to a new joint advisory by the FBI and the Cybersecurity and Infrastructure Security Agency.<\/p>\n\n\n\n

That\u2019s an increase from the 49 U.S. victims and $43 million in ransom payments detailed<\/a> in a December 2021 FBI flash alert. Many of the organizations targeted by the group are designated as critical infrastructure, with the agencies flagging the financial services, government, healthcare, manufacturing and information technology sectors as top targets.<\/p>\n\n\n\n

Cuba ransomware has also compromised at least an additional 36 entities outside of the U.S. over that same period.<\/p>\n\n\n\n

To do this, the group has mostly been \u201cliving off the land\u201d to carry out attacks, relying on a mix of known vulnerabilities, phishing campaigns, commercial remote desktop tools and stolen credentials to gain access to victim systems and deploy malware.<\/p>\n\n\n\n

However, citing research from Palo Alto Networks, the agencies said that since May 2022, the group has been observed deploying a number of new tactics, techniques and procedures. According to Palo Alto Networks’ Unit 42 security research team, those changes include<\/a> the use of the ROMCOM RAT malware family, the ZeroLogon vulnerability, local privilege escalation exploits and a kernel driver that specifically targets security products. Read On:<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Derek B. Johnson – The Cuba ransomware group has doubled its number of American victims over the past year, infecting at least 65 U.S. entities across a broad range of critical infrastructure sectors and stealing more than $60 million in ransom …<\/span> Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":76430,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_seo_schema_type":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[636],"tags":[637],"class_list":["post-71450","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ransomware","tag-ransomware"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2022\/12\/havana-1376099_1920-1536x1024-1.jpg?fit=1536%2C1024&ssl=1","jetpack-related-posts":[{"id":77730,"url":"https:\/\/blog.cyberconservices.com\/index.php\/2025\/03\/24\/cybersecurity-officials-warn-against-potential-ransomware-attacks-involving-email-vpns\/","url_meta":{"origin":71450,"position":0},"title":"Cybersecurity officials warn against potential\u00a0ransomware\u00a0attacks involving email, VPNs","author":"Rick Backus","date":"March 24, 2025","format":false,"excerpt":"A ransomware-as-a-service software called Medusa, which has launched ransomware attacks since 2021, has recently affected hundreds of people.","rel":"","context":"In "Ransomware"","block_context":{"text":"Ransomware","link":"https:\/\/blog.cyberconservices.com\/index.php\/category\/ransomware\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/03\/cyber-security-3194286_1280.jpg?fit=1200%2C720&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/03\/cyber-security-3194286_1280.jpg?fit=1200%2C720&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/03\/cyber-security-3194286_1280.jpg?fit=1200%2C720&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/03\/cyber-security-3194286_1280.jpg?fit=1200%2C720&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/03\/cyber-security-3194286_1280.jpg?fit=1200%2C720&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":76711,"url":"https:\/\/blog.cyberconservices.com\/index.php\/2023\/04\/06\/cisas-pre-ransomware-notifications-help-organizations-stop-attacks-before-damage-occurs\/","url_meta":{"origin":71450,"position":1},"title":"CISA’s Pre-Ransomware Notifications Help Organizations Stop Attacks Before Damage Occurs","author":"Rick Backus","date":"April 6, 2023","format":false,"excerpt":"By Clayton Romans - Over the past several years, ransomware attacks have caused extraordinary harm to American organizations: schools forced to close, hospitals required to divert patients, companies across all sectors facing operational disruption and expending untold sums on mitigation and recovery. At CISA, we are working with partners to\u2026","rel":"","context":"In "Ransomware"","block_context":{"text":"Ransomware","link":"https:\/\/blog.cyberconservices.com\/index.php\/category\/ransomware\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":76717,"url":"https:\/\/blog.cyberconservices.com\/index.php\/2023\/04\/25\/ransomware-101-exploring-its-inner-workings\/","url_meta":{"origin":71450,"position":2},"title":"Ransomware 101: Exploring Its Inner Workings","author":"Rick Backus","date":"April 25, 2023","format":false,"excerpt":"Ransomware is a type of malicious software that encrypts files and demands payment for decryption. It is a growing threat to businesses and individuals, with increasingly sophisticated attack methods. Understanding how ransomware works is crucial to protecting yourself and your data.","rel":"","context":"In "Blog"","block_context":{"text":"Blog","link":"https:\/\/blog.cyberconservices.com\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2023\/04\/Kidnappers-1.png?fit=1024%2C1024&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2023\/04\/Kidnappers-1.png?fit=1024%2C1024&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2023\/04\/Kidnappers-1.png?fit=1024%2C1024&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2023\/04\/Kidnappers-1.png?fit=1024%2C1024&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":77628,"url":"https:\/\/blog.cyberconservices.com\/index.php\/2025\/01\/28\/todays-business-how-to-combat-the-growing-threat-of-ransomware\/","url_meta":{"origin":71450,"position":3},"title":"Today’s Business: How to combat the growing threat of ransomware","author":"Rick Backus","date":"January 28, 2025","format":false,"excerpt":"In today's digital era, ransomware has become one of the most dangerous cybersecurity threats, affecting organizations of all sizes.","rel":"","context":"In "Ransomware"","block_context":{"text":"Ransomware","link":"https:\/\/blog.cyberconservices.com\/index.php\/category\/ransomware\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/01\/ai-generated-8560465_1280.jpg?fit=1200%2C679&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/01\/ai-generated-8560465_1280.jpg?fit=1200%2C679&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/01\/ai-generated-8560465_1280.jpg?fit=1200%2C679&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/01\/ai-generated-8560465_1280.jpg?fit=1200%2C679&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/01\/ai-generated-8560465_1280.jpg?fit=1200%2C679&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":77610,"url":"https:\/\/blog.cyberconservices.com\/index.php\/2025\/01\/14\/space-bears-ransomware-what-you-need-to-know\/","url_meta":{"origin":71450,"position":4},"title":"Space Bears Ransomware: What You Need To Know","author":"Rick Backus","date":"January 14, 2025","format":false,"excerpt":"On another page, alongside a friendly corporate stock image, Space Bears offers \"guarantees\" of what it will do if your company pays its ransom.","rel":"","context":"In "Ransomware"","block_context":{"text":"Ransomware","link":"https:\/\/blog.cyberconservices.com\/index.php\/category\/ransomware\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/01\/space-bears-trust.jpeg?fit=600%2C456&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/01\/space-bears-trust.jpeg?fit=600%2C456&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2025\/01\/space-bears-trust.jpeg?fit=600%2C456&ssl=1&resize=525%2C300 1.5x"},"classes":[]},{"id":76218,"url":"https:\/\/blog.cyberconservices.com\/index.php\/2023\/02\/27\/76218\/","url_meta":{"origin":71450,"position":5},"title":"An Overview of the Global Impact of Ransomware Attacks","author":"Rick Backus","date":"February 27, 2023","format":false,"excerpt":"On December 12th, 2022, there was a\u00a0cyberattack\u00a0in the Swedish municipalities of Borgholm and M\u00f6rbyl\u00e5nga that rendered a range of critical services from both municipalities unavailable. Although the nature of the intrusion is still undisclosed, it seems to be part of a wider trend of global ransomware attacks. On January 10th,\u2026","rel":"","context":"In "Ransomware"","block_context":{"text":"Ransomware","link":"https:\/\/blog.cyberconservices.com\/index.php\/category\/ransomware\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2023\/03\/viking-4898879_1920-1536x1152-1-1.jpg?fit=1200%2C900&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2023\/03\/viking-4898879_1920-1536x1152-1-1.jpg?fit=1200%2C900&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2023\/03\/viking-4898879_1920-1536x1152-1-1.jpg?fit=1200%2C900&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2023\/03\/viking-4898879_1920-1536x1152-1-1.jpg?fit=1200%2C900&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/blog.cyberconservices.com\/wp-content\/uploads\/2023\/03\/viking-4898879_1920-1536x1152-1-1.jpg?fit=1200%2C900&ssl=1&resize=1050%2C600 3x"},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/posts\/71450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/comments?post=71450"}],"version-history":[{"count":0,"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/posts\/71450\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/media\/76430"}],"wp:attachment":[{"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/media?parent=71450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/categories?post=71450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/tags?post=71450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}