Ministerio de Relaciones Exteriores de Cuba

Summary

The official YouTube channel of Cuba's Ministry of Foreign Affairs was compromised by malicious actors in a cyberattack described as an act of cybercrime and digital harassment against Cuban institutions. The Ministry issued a public statement denouncing the intrusion, clarifying that any content published while the account was under unauthorized control did not reflect the position of the Cuban government or any state institution. Technical teams were engaged to restore full control of the channel, strengthen its security measures, and prevent similar incidents in the future. The event fits a broader pattern of recurring cyber aggression targeting the Ministry, including a large-scale distributed denial-of-service attack against its official web portal and subsequent attacks on the institution's online infrastructure that officials have linked to a coordinated information warfare campaign against the country.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 7, 2025, the Ministry of Foreign Affairs of the Republic of Cuba (Cancillería) publicly denounced that its official YouTube channel had been compromised by malicious actors. Through an official communication issued from Havana, the Ministry described the event as a clear manifestation of cybercrime, aligning it with a broader pattern of digital harassment that Cuban institutions have repeatedly reported over the years. The Ministry framed the intrusion not as an isolated technical failure but as part of ongoing hostile operations directed against Cuba's official communication channels. In its statement, the Cancillería specified that its institutional channel on the YouTube platform had been subjected to a security breach by malintencionated actors on a recent date, without providing the exact day of the initial compromise.

The immediate impact of the intrusion was the unauthorized publication of content on the channel during the period in which the account remained outside the Ministry's control. The Cancillería issued an explicit disclaimer stating that any material disseminated while the account's security was compromised did not represent, in any form, the position of the Government of Cuba, of the Ministry itself, or of any Cuban institution. This disclaimer was designed to mitigate reputational damage and to prevent misinformation from being attributed to official Cuban diplomatic messaging. The Ministry did not disclose the specific nature of the fraudulent content, the volume of posts uploaded, or the duration of the unauthorized access, focusing its public communication instead on condemning the act and reaffirming its institutional stance.

Following the discovery of the compromise, the Cancillería activated a coordinated response with the pertinent technical authorities to regain full control of the YouTube channel, reinforce its security measures, and prevent future actions of this nature. Although the Ministry did not detail the specific technical steps taken—such as password resets, session revocations, two-factor authentication enforcement, or platform-level account recovery—the public statement confirmed that recovery and hardening operations were underway at the time of the announcement. The Ministry also reiterated its firm rejection of these illicit practices and its determination to defend Cuba's sovereign voice across all digital spaces, signaling an institutional commitment to both remediation and resilience against future incidents.

Contextual reporting indicates that this incident fits within a documented history of cyber aggressions targeting Cuban diplomatic infrastructure. According to historical references cited in coverage of the July 2025 event, in 2021 the official web portal of the Ministry of Foreign Affairs suffered a massive attack as part of a communicative and cyber campaign against the Island. That earlier assault was executed from 34 IP addresses that generated up to 10,000 simultaneous accesses each, with the objective of collapsing the system. During that same period, the Cubavsbloqueo site also reported a similar denial-of-service attempt, with most of the originating addresses located in the United States. The volume of fraudulent traffic was significant: approximately 580,000 accesses were recorded in just half an hour, a figure far exceeding the normal daily traffic of the website, which compromised the response capacity of the Ministry's international servers.

A subsequent wave of attacks was publicly denounced in December 2022 by Cuban Foreign Minister Bruno Rodríguez, who reported organized cyber attacks against the Ministry's official web page. Rodríguez characterized those aggressions as part of an unconventional and communicative warfare strategy directed against Cuba, asserting that such actions violated the principles governing the peaceful and responsible use of cyberspace. The recurrence of these incidents over multiple years demonstrates that the July 2025 YouTube channel compromise occurred within an established operational pattern of hostile cyber activity targeting Cuban official channels. While the 2021 and 2022 incidents involved denial-of-service attacks against web infrastructure, the 2025 event represented a different attack vector—account takeover on a third-party social media platform—suggesting an evolution in the tactics employed against Cuban diplomatic assets.

The Ministry's public response to the 2025 incident combined technical remediation with political messaging. On one hand, it coordinated with technical authorities to restore control and harden the channel's defenses. On the other, it used the denunciation as an opportunity to reaffirm Cuba's sovereign narrative in digital environments and to document, once again, the pattern of cyber aggressions the country faces. The statement was issued from La Habana on July 7, 2025, and disseminated through both the Ministry's own communication channels and international coverage, including state-aligned media outlets that corroborated the timeline and content of the official declaration.

Sources

Sources available to members: 2 sources.