Cyber Incident Victim: Universidad de La Habana
Date:
Jan 2023
Location:
Cuba
Summary
Anonymous Cuba, a group identifying as Cuban hackers advocating for human rights and resistance to tyranny, disabled certain departmental web pages of the University of Havana in protest against government repression and societal conditions. The action was framed as a response to political leadership and intended to highlight systemic issues, with the group using social media to declare their motivations under the hashtag #SOSCUBA. No additional technical details or institutional responses were reported at the time.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around January 6, 2023, an entity identifying itself as "Anonymous Cuba" executed a cyber incident targeting the University of Havana by disabling access to certain departmental web pages. The action was publicly claimed through a Twitter account named "La Resistencia Cuba," which is affiliated with Anonymous Cuba and describes itself as a collective of "Cuban hackers for human rights, autonomy and self-governance, resistance to tyranny, for the freedom of our people." The group framed the attack as a direct response to Cuban President Miguel Díaz-Canel's public statements, declaring, "This is our response to Díaz-Canel’s message to the people." Their accompanying social media post criticized Cuba's political and socioeconomic conditions, asserting, "Cubans, understand, everything is a farce. We are light years away from the world, everything is a lie. We could not let this sad day go by without doing anything, one more year of misery and repression." The message concluded with the hashtag #SOSCUBA, aligning the incident with broader anti-government sentiment.
No technical specifics regarding the attack methodology—such as intrusion vectors, tools used, or duration of disruption—were disclosed in available sources. The University of Havana did not issue any public statements acknowledging the incident via its official website or social media channels at the time of reporting. Similarly, no third-party confirmation of operational impacts, data exfiltration, or financial consequences was documented. The attackers did not provide evidence of data compromise, contrasting with typical ransomware group tactics observed in contemporaneous incidents like those involving CL0P or ALPHV. Anonymous Cuba’s actions appeared primarily symbolic, leveraging website defacement or disruption to amplify political dissent rather than pursuing overtly financial or data-centric objectives. The incident remained confined to departmental page disruptions, with no evidence of broader network compromise or secondary attacks disclosed in the source material.