McAfee Defender’s Blog: Cuba Ransomware Campaign | McAfee Blogs

Cuba Ransomware Overview

Over the past year, we have seen ransomware attackers change the way they have responded to organizations that have either chosen to not pay the ransom or have recovered their data via some other means. At the end of the day, fighting ransomware has resulted in the bad actors’ loss of revenue. Being the creative bunch they are, they have resorted to data dissemination if the ransom is not paid. This means that significant exposure could still exist for your organization, even if you were able to recover from the attack.

Cuba ransomware, no newcomer to the game, has recently introduced this behavior.

This blog is focused on how to build an adaptable security architecture to increase your resilience against these types of attacks and specifically, how McAfee’s portfolio delivers the capability to prevent, detect and respond against the tactics and techniques used in the Cuba Ransomware Campaign.

Gathering Intelligence on Cuba Ransomware

As always, building adaptable defensive architecture starts with intelligence. In most organizations, the Security Operations team is responsible for threat intelligence analysis, as well as threat and incident response. McAfee Insights (https://www.mcafee.com/enterprise/en-us/lp/insights-dashboard1.html#) is a great tool for the threat intel analyst and threat responder. The Insights Dashboard identifies prevalence and severity of emerging threats across the globe which enables the Security Operations Center (SOC) to prioritize threat response actions and gather relevant cyber threat intelligence (CTI) associated with the threat, in this case the Cuba ransomware campaign. The CTI is provided in the form of technical indicators of compromise (IOCs) as well as MITRE ATT&CK framework tactics and techniques. As a threat intel analyst or responder you can drill down to gather more specific information on Cuba ransomware, such as prevalence and links to other sources of information. You can further drill down to gather more specific actionable intelligence such as indicators of compromise and tactics/techniques aligned to the MITRE ATT&CK framework.

From the McAfee Advanced Threat Research (ATR) blog, you can see that Cuba ransomware leverages tactics and techniques common to other APT campaigns. Currently, the Initial Access vector is not known. It could very well be spear phishing, exploited system tools and signed binaries, or a multitude of other popular methods.

Defensive Architecture Overview

Today’s digital enterprise is a hybrid environment of on-premise systems and cloud services with multiple entry points for attacks like Cuba ransomware. The work from home operating model forced by COVID-19 has only expanded the attack surface and increased risk for successful spear phishing attacks if organizations did not adapt their security posture and increase training for remote workers. Mitigating the risk of attacks like Cuba ransomware requires a security architecture with the right controls at the device, on the network and in security operations (SecOps). The Center for Internet Security (CIS) Top 20 Cyber Security Controls provides a good guide to build that architecture. As indicated earlier, the exact entry vector used by Cuba ransomware is currently unknown, so what follows, here, are more generalized recommendations for protecting your enterprise.

Initial Access Stage Defensive Overview

According to Threat Intelligence and Research, the initial access for Cuba ransomware is not currently known. As attackers can leverage many popular techniques for initial access, it is best to validate efficacy on all layers of defenses. This includes user awareness training and response procedures, intelligence and behavior-based malware defenses on email systems, web proxy and endpoint systems, and finally SecOps playbooks for early detection and response against suspicious email attachments or other phishing techniques. The following chart summarizes the controls expected to have the most effect against initial stage techniques and the McAfee solutions to implement those controls where applicable.

MITRE Tactic	MITRE Techniques	CSC Controls	McAfee Capability
Initial Access	Spear Phishing Attachments (T1566.001)	CSC 7 – Email and Web Browser Protection CSC 8 – Malware Defenses CSC 17 – User Awareness	Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Web Gateway (MWG), Advanced Threat Defense, Web Gateway Cloud Service (WGCS)
Initial Access	Spear Phishing Link (T1566.002)	CSC 7 – Email and Web Browser Protection CSC 8 – Malware Defenses CSC 17 – User Awareness	Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Web Gateway (MWG), Advanced Threat Defense, Web Gateway Cloud Service (WGCS)
Initial Access	Spear Phishing (T1566.003) Service	CSC 7 – Email and Web Browser Protection CSC 8 – Malware Defenses CSC 17 – User Awareness	Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Web Gateway (MWG), Advanced Threat Defense, Web Gateway Cloud Service (WGCS)

For additional information on how McAfee can protect against suspicious email attachments, review this additional blog post: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-protects-against-suspicious-email-attachments/

Exploitation Stage Defensive Overview

The exploitation stage is where the attacker gains access to the target system. Protection against Cuba ransomware at this stage is heavily dependent on adaptable anti-malware on both end user devices and servers, restriction of application execution, and security operations tools like endpoint detection and response sensors.

McAfee Endpoint Security 10.7 provides a defense in depth capability, including signatures and threat intelligence, to cover known bad indicators or programs, as well as machine-learning and behavior-based protection to reduce the attack surface against Cuba ransomware and detect new exploitation attack techniques. If the initial entry vector is a weaponized Word document with links to external template files on a remote server, for example, McAfee Threat Prevention and Adaptive Threat Protection modules protect against these techniques.

The following chart summarizes the critical security controls expected to have the most effect against exploitation stage techniques and the McAfee solutions to implement those controls where applicable.

MITRE Tactic	MITRE Techniques	CSC Controls	McAfee Portfolio Mitigation
Execution	User Execution (T1204)	CSC 5 Secure Configuration CSC 8 Malware Defenses CSC 17 Security Awareness	Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Application Control (MAC), Web Gateway and Network Security Platform
Execution	Command and Scripting Interpreter (T1059)	CSC 5 Secure Configuration CSC 8 Malware Defenses	Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Application Control (MAC), MVISION EDR
Execution	Shared Modules (T1129)	CSC 5 Secure Configuration CSC 8 Malware Defenses	Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Application Control (MAC)
Persistence	Boot or Autologon Execution (T1547)	CSC 5 Secure Configuration CSC 8 Malware Defenses	Endpoint Security Platform 10.7 Threat Prevention, MVISION EDR
Defensive Evasion	Template Injection (T1221)	CSC 5 Secure Configuration CSC 8 Malware Defenses	Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, MVISION EDR
Defensive Evasion	Signed Binary Proxy Execution (T1218)	CSC 4 Control Admin Privileges CSC 5 Secure Configuration CSC 8 Malware Defenses	Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Application Control, MVISION EDR
Defensive Evasion	Deobfuscate/Decode Files or Information (T1027)	CSC 5 Secure Configuration CSC 8 Malware Defenses	Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, MVISION EDR

For more information on how McAfee Endpoint Security 10.7 can prevent some of the techniques used in the Cuba ransomware exploit stage, review this additional blog post: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-amsi-integration-protects-against-malicious-scripts/

Impact Stage Defensive Overview

The impact stage is where the attacker encrypts the target system, data and perhaps moves laterally to other systems on the network. Protection at this stage is heavily dependent on adaptable anti-malware on both end user devices and servers, network controls and security operation’s capability to monitor logs for anomalies in privileged access or network traffic. The following chart summarizes the controls expected to have the most effect against impact stage techniques and the McAfee solutions to implement those controls where applicable:

The public leak site of Cuba ransomware can be found via TOR: http://cuba4mp6ximo2zlo[.]onion/

MITRE Tactic	MITRE Techniques	CSC Controls	McAfee Portfolio Mitigation
Discovery	Account Discovery (T1087)	CSC 4 Control Use of Admin Privileges CSC 5 Secure Configuration CSC 6 Log Analysis	MVISION EDR, MVISION Cloud, Cloud Workload Protection
Discovery	System Information Discovery (T1082)	CSC 4 Control Use of Admin Privileges CSC 5 Secure Configuration CSC 6 Log Analysis	MVISION EDR, MVISION Cloud, Cloud Workload Protection
Discovery	System Owner/User Discovery (T1033)	CSC 4 Control Use of Admin Privileges CSC 5 Secure Configuration CSC 6 Log Analysis	MVISION EDR, MVISION Cloud, Cloud Workload Protection
Command and Control	Encrypted Channel (T1573)	CSC 8 Malware Defenses CSC 12 Boundary Defenses	Web Gateway, Network Security Platform

 

Hunting for Cuba Ransomware Indicators

As a threat intel analyst or hunter, you might want to quickly scan your systems for any indicators you received on Cuba ransomware. Of course, you can do that manually by downloading a list of indicators and searching with available tools. However, if you have MVISION EDR and Insights, you can do that right from the console, saving precious time. Hunting the attacker can be a game of inches so every second counts. Of course, if you found infected systems or systems with indicators, you can take action to contain and start an investigation for incident response immediately from the MVISION EDR console.

In addition to these IOCs, YARA rules are available in our technical analysis of Cuba ransomware.

IOCs:

Files:

151.bat

151.ps1

Kurva.ps1

 

Email addresses:

under_amur@protonmail[.]ch

helpadmin2@cock[.]li

helpadmin2@protonmail[.]com

iracomp2@protonmail[.]ch

fedelsupportagent@cock.li

admin@cuba-supp.com

cuba_support@exploit.im

 

Domain:

kurvalarva[.]com

 

Script for lateral movement and deployment:

54627975c0befee0075d6da1a53af9403f047d9e367389e48ae0d25c2a7154bc

c385ef710cbdd8ba7759e084051f5742b6fa8a6b65340a9795f48d0a425fec61

40101fb3629cdb7d53c3af19dea2b6245a8d8aa9f28febd052bb9d792cfbefa6

 

Cuba Ransomware:

c4b1f4e1ac9a28cc9e50195b29dde8bd54527abc7f4d16899f9f8315c852afd4

944ee8789cc929d2efda5790669e5266fe80910cabf1050cbb3e57dc62de2040
78ce13d09d828fc8b06cf55f8247bac07379d0c8b8c8b1a6996c29163fa4b659
33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e

672fb249e520f4496e72021f887f8bb86fec5604317d8af3f0800d49aa157be1
e942a8bcb3d4a6f6df6a6522e4d5c58d25cdbe369ecda1356a66dacbd3945d30

907f42a79192a016154f11927fbb1e6f661f679d68947bddc714f5acc4aa66eb
28140885cf794ffef27f5673ca64bd680fc0b8a469453d0310aea439f7e04e64
271ef3c1d022829f0b15f2471d05a28d4786abafd0a9e1e742bde3f6b36872ad
6396ea2ef48aa3d3a61fb2e1ca50ac3711c376ec2b67dbaf64eeba49f5dfa9df

bda4bddcbd140e4012bab453e28a4fba86f16ac8983d7db391043eab627e9fa1

7a17f344d916f7f0272b9480336fb05d33147b8be2e71c3261ea30a32d73fecb

c206593d626e1f8b9c5d15b9b5ec16a298890e8bae61a232c2104cbac8d51bdd

9882c2f5a95d7680626470f6c0d3609c7590eb552065f81ab41ffe074ea74e82

c385ef710cbdd8ba7759e084051f5742b6fa8a6b65340a9795f48d0a425fec61
54627975c0befee0075d6da1a53af9403f047d9e367389e48ae0d25c2a7154bc
1f825ef9ff3e0bb80b7076ef19b837e927efea9db123d3b2b8ec15c8510da647
40101fb3629cdb7d53c3af19dea2b6245a8d8aa9f28febd052bb9d792cfbefa6

00ddbe28a31cc91bd7b1989a9bebd43c4b5565aa0a9ed4e0ca2a5cfb290475ed

729950ce621a4bc6579957eabb3d1668498c805738ee5e83b74d5edaf2f4cb9e

 

MITRE ATT&CK Techniques:

Tactic	Technique	Observable	IOCs
Execution	Command and Scripting Interpreter: PowerShell (T1059.001)	Cuba team is using PowerShell payload to drop Cuba ransomware	f739977004981fbe4a54bc68be18ea79 68a99624f98b8cd956108fedcc44e07c bdeb5acc7b569c783f81499f400b2745
Execution	System Services: Service Execution (T1569.002)
Execution	Shared Modules (T1129)	Cuba ransomware links function at runtime	Functions: “GetModuleHandle” “GetProcAddress” “GetModuleHandleEx”
Execution	Command and Scripting Interpreter (T1059)	Cuba ransomware accepts command line arguments	Functions: “GetCommandLine”
Persistence	Create or Modify System Process: Windows Service (T1543.003)	Cuba ransomware can modify services	Functions: “OpenService” “ChangeServiceConfig”
Privilege Escalation	Access Token Manipulation (T1134)	Cuba ransomware can adjust access privileges	Functions: “SeDebugPrivilege” “AdjustTokenPrivileges” “LookupPrivilegeValue”
Defense Evasion	File and Directory Permissions Modification (T1222)	Cuba ransomware will set file attributes	Functions: “SetFileAttributes”
Defense Evasion	Obfuscated files or Information (T1027)	Cuba ransomware is using xor algorithm to encode data
Defense Evasion	Virtualization/Sandbox Evasion: System Checks	Cuba ransomware executes anti-vm instructions
Discovery	File and Directory Discovery (T1083)	Cuba ransomware enumerates files	Functions: “FindFirstFile” “FindNextFile” “FindClose” “FindFirstFileEx” “FindNextFileEx” “GetFileSizeEx”
Discovery	Process Discovery (T1057)	Cuba ransomware enumerates process modules	Functions: “K32EnumProcesses”
Discovery	System Information Discovery (T1082)	Cuba ransomware can get keyboard layout, enumerates disks, etc	Functions: “GetKeyboardLayoutList” “FindFirstVolume” “FindNextVolume” “GetVolumePathNamesForVolumeName” “GetDriveType” “GetLogicalDriveStrings” “GetDiskFreeSpaceEx”
Discovery	System Service Discovery (T1007)	Cuba ransomware can query service status	Functions: “QueryServiceStatusEx”
Collection	Input Capture: Keylogging (T1056.001)	Cuba ransomware logs keystrokes via polling	Functions: “GetKeyState” “VkKeyScan”
Impact	Service Stop (T1489)	Cuba ransomware can stop services
Impact	Data encrypted for Impact (T1486)	Cuba ransomware encrypts data

 

Proactively Detecting Cuba Ransomware Techniques

Many of the exploit stage techniques in this attack could use legitimate Windows processes and applications to either exploit or avoid detection. We discussed, above, how the Endpoint Protection Platform can disrupt weaponized documents but, by using MVISION EDR, you can get more visibility. As security analysts, we want to focus on suspicious techniques used by Initial Access, as this attack’s Initial Access is unknown.

Monitoring or Reporting on Cuba Ransomware Events

Events from McAfee Endpoint Protection and McAfee MVISION EDR play a key role in Cuba ransomware incident and threat response. McAfee ePO centralizes event collection from all managed endpoint systems. As a threat responder, you may want to create a dashboard for Cuba ransomware-related threat events to understand your current exposure.

Summary

To defeat targeted threat campaigns, defenders must collaborate internally and externally to build an adaptive security architecture which will make it harder for threat actors to succeed and build resilience in the business. This blog highlights how to use McAfee’s security solutions to prevent, detect and respond to Cuba ransomware and attackers using similar techniques.

McAfee ATR is actively monitoring this campaign and will continue to update McAfee Insights and its social networking channels with new and current information. Want to stay ahead of the adversaries? Check out McAfee Insights for more information.