[ad_1]
The Cuba ransomware operation is exploiting Microsoft Change vulnerabilities to realize preliminary entry to company networks and encrypt units.
Cybersecurity agency Mandiant tracks the ransomware gang as UNC2596 and the ransomware itself as COLDDRAW. Nonetheless, the ransomware is extra generally often known as Cuba, which is how BleepingComputer will reference them all through this text.
Cuba is a ransomware operation that launched on the finish of 2019, and whereas they began sluggish, they started to select up pace in 2020 and 2021. This improve in exercise led to the FBI issuing a Cuba ransomware advisory in December 2021, warning that the gang breached 49 essential infrastructure organizations within the U.S.
In a brand new report by Mandiant, researchers present that the Cuba operation primarily targets the US, adopted by Canada.
Supply: Mandiant
Mixing commodity and customized malware
The Cuba ransomware gang was seen leveraging Microsoft Change vulnerabilities to deploy net shells, RATs, and backdoors to ascertain their foothold on the goal community since August 2021.
“Mandiant has additionally recognized the exploitation of Microsoft Change vulnerabilities, together with ProxyShell and ProxyLogon, as one other entry level leveraged by UNC2596 doubtless as early as August 2021,” explains Mandiant in a new report.
The planted backdoors embrace Cobalt Strike or the NetSupport Supervisor distant entry device, however the group additionally makes use of their very own ‘Bughatch’, ‘Wedgecut’, and ‘eck.exe”, and Burntcigar’ instruments.
Wedgecut comes within the type of an executable named “test.exe,” which is a reconnaissance device that enumerates the Energetic Listing via PowerShell.
Bughatch is a downloader that fetches PowerShell scripts and recordsdata from the C&C server. To evade detection, it hundreds in reminiscence from a distant URL.
Burntcigar is a utility that may terminate processes on the kernel stage by exploiting a flaw in an Avast driver, which is included with the device for a “convey your individual susceptible driver” assault.
Lastly, there’s a memory-only dropper that fetches the above payloads and hundreds them, referred to as Termite. Nonetheless, this device has been noticed in campaigns of a number of menace teams, so it’s not used completely by the Cuba menace actors.
The menace actors escalate privileges utilizing stolen account credentials sourced via the available Mimikatz and Wicker instruments.
Then they carry out community reconnaissance with Wedgecut, and subsequent, they transfer laterally with RDP, SMB, PsExec, and Cobalt Strike.
The next deployment is Bughatch loaded by Termite, adopted by Burntcigar, which lays the bottom for knowledge exfiltration and file encryption by deactivating safety instruments.
The Cuba gang doesn’t use any cloud providers for the exfiltration step however as a substitute sends every thing onto their very own non-public infrastructure.
Supply: Mandiant
An evolving operation
Again in Could 2021, Cuba ransomware partnered with the spam operators of the Hancitor malware to realize entry to company networks via DocuSign phishing emails.
Since then, Cuba has advanced its operations to focus on public-facing providers vulnerabilities, such because the Microsoft Change ProxyShell and ProxyLogon vulnerabilities.
This shift makes the assaults stronger but additionally simpler to thwart, as safety updates that plug the exploited points have been obtainable for a lot of months now.
The Cuba operation will doubtless flip its consideration to different vulnerabilities as soon as there are not any extra useful targets working unpatched Microsoft Change servers.
Because of this making use of the obtainable safety updates as quickly because the software program distributors launch them is essential in sustaining a strong safety stance in opposition to even essentially the most subtle menace actors.
[ad_2]
