Cuba

Profile narrative

The Cuba Gang, also tracked as Cuba, is a ransomware‑operating threat actor that has been active since at least 2019 and is publicly associated with Brazil. The group uses the Cuba ransomware strain to encrypt victim systems and typically follows encryption with threats to leak or sell stolen data unless a payment is made. Observed activity shows a focus on extortion rather than pure disruption, with victims often offered identity‑theft protection or notified of potential data misuse after an intrusion.

Targeting has spanned multiple sectors and regions. Healthcare organizations such as the Rock County Public Health Department, Professional Healthcare Management and Forefront Dermatology have been hit, exposing personal health information, Social Security numbers and related records. Government entities including Montenegro’s parliament and Brazil’s Agência Nacional de Águas e Saneamento Básico have also been subjected to attacks that disrupted critical services and prompted claims of data theft. The actor has additionally pursued IT service providers, payment processors like Automatic Funds Transfer Services, and other commercial victims, affecting organizations across the United States, Brazil and Europe. The stated objective in these incidents is financial gain through ransom demands and the monetization of exfiltrated data.

Typical tactics involve initial access via malicious email attachments, as seen in the Ottawa‑area IT services firm incident, followed by the deployment of unauthorized scripts that encrypt drives, including network‑attached backup systems. The Cuba ransomware strain is then used to lock files, while actors exfiltrate system and network data such as login credentials, often noting weak password practices. After encryption, the group publishes claims on a Tor‑based leak site, threatens to release or sell the stolen information, and attempts to profit from the data if ransom payments are not received. Victims have reported that offline or isolated backups sometimes prevented full encryption, highlighting the group’s reliance on online backup vectors for impact.

Attribution assessments from open‑source research and official alerts suggest a possible nexus to Russian‑speaking actors. Researchers have linked the Cuba gang to potential Russian state connections, and FBI analysis indicated the group likely includes Russian speakers, with allegations that the Russian government may shield or employ such cybercriminals. Despite these links, the gang is treated as a financially motivated criminal operation, and the FBI has noted that the actors have received tens of millions of dollars from victims across roughly fifty targeted entities. Representative campaigns include the 2023 Rock County ransomware event affecting over twenty‑five thousand individuals, the 2022 Montenegro parliament intrusion where Cuba claimed theft of financial records and source code, the 2021 Automatic Funds Transfer Services breach that exposed data from multiple U.S. municipalities and the California DMV, the 2021 Forefront Dermatology attack that exfiltrated over one hundred credential sets, and the 2022 Ottawa‑area IT services firm incident that began with a malicious attachment and was recovered using offline backups. These examples illustrate the group’s reliance on ransomware, data extortion, and opportunistic targeting of both private and public sector networks.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 2 sources.