www.bleepingcomputer.com
Open in
urlscan Pro
104.20.60.209
Public Scan
Submitted URL: https://t.co/RVACFVvsir
Effective URL: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-cuba-ransomware/
Submission: On April 14 via api from US — Scanned from DE
Effective URL: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-cuba-ransomware/
Submission: On April 14 via api from US — Scanned from DE
Form analysis 6 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-cuba-ransomware/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-cuba-ransomware/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-cuba-ransomware/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
* News
* Featured
* Latest
* US warns of govt hackers targeting industrial control systems
* Critical Apache Struts RCE vulnerability wasn't fully fixed, patch now
* Microsoft disrupts Zloader malware in global operation
* OldGremlin ransomware gang targets Russia with new malware
* Hackers target Ukrainian govt with IcedID malware, Zimbra exploits
* Hetzner lost customer data and gave 20€ as compensation
* The top 10 password attacks and how to stop them
* Instagram beyond pics: Sexual harassers, crypto crooks, ID thieves
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to Translate a Web Page in Google Chrome
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Microsoft Exchange servers hacked to deploy Cuba ransomware
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditRedditShare to Hacker NewsHacker NewsShare to
EmailEmail
*
MICROSOFT EXCHANGE SERVERS HACKED TO DEPLOY CUBA RANSOMWARE
By
BILL TOULAS
* February 24, 2022
* 12:06 PM
* 1
The Cuba ransomware operation is exploiting Microsoft Exchange vulnerabilities
to gain initial access to corporate networks and encrypt devices.
Cybersecurity firm Mandiant tracks the ransomware gang as UNC2596 and the
ransomware itself as COLDDRAW. However, the ransomware is more commonly known as
Cuba, which is how BleepingComputer will reference them throughout this article.
Cuba is a ransomware operation that launched at the end of 2019, and while they
started slow, they began to pick up speed in 2020 and 2021. This increase in
activity led to the FBI issuing a Cuba ransomware advisory in December 2021,
warning that the gang breached 49 critical infrastructure organizations in the
U.S.
PLAY Top Articles Video Settings Full Screen About Connatix V158870 Read More
Read More Read More Read More Read More Read More Flaw in Rarible NFT market
allowed trickycrypto asset transfers 1/1 Skip Ad Continue watching after the ad
Visit Advertiser websiteGO TO PAGE
In a new report by Mandiant, researchers show that the Cuba operation primarily
targets the United States, followed by Canada.
Cuba ransomware victims heat map
Source: Mandiant
MIXING COMMODITY AND CUSTOM MALWARE
The Cuba ransomware gang was seen leveraging Microsoft Exchange vulnerabilities
to deploy web shells, RATs, and backdoors to establish their foothold on the
target network since August 2021.
"Mandiant has also identified the exploitation of Microsoft Exchange
vulnerabilities, including ProxyShell and ProxyLogon, as another access point
leveraged by UNC2596 likely as early as August 2021," explains Mandiant in a new
report.
The planted backdoors include Cobalt Strike or the NetSupport Manager remote
access tool, but the group also uses their own ‘Bughatch’, ‘Wedgecut’, and
‘eck.exe”, and Burntcigar’ tools.
Wedgecut comes in the form of an executable named “check.exe,” which is a
reconnaissance tool that enumerates the Active Directory through PowerShell.
Bughatch is a downloader that fetches PowerShell scripts and files from the C&C
server. To evade detection, it loads in memory from a remote URL.
Burntcigar is a utility that can terminate processes at the kernel level by
exploiting a flaw in an Avast driver, which is included with the tool for a
“bring your own vulnerable driver” attack.
Finally, there’s a memory-only dropper that fetches the above payloads and loads
them, called Termite. However, this tool has been observed in campaigns of
multiple threat groups, so it’s not used exclusively by the Cuba threat actors.
The threat actors escalate privileges using stolen account credentials sourced
through the readily available Mimikatz and Wicker tools.
Then they perform network reconnaissance with Wedgecut, and next, they move
laterally with RDP, SMB, PsExec, and Cobalt Strike.
The subsequent deployment is Bughatch loaded by Termite, followed by Burntcigar,
which lays the ground for data exfiltration and file encryption by deactivating
security tools.
The Cuba gang doesn’t use any cloud services for the exfiltration step but
instead sends everything onto their own private infrastructure.
Cuba ransomware note to victims
Source: Mandiant
AN EVOLVING OPERATION
Back in May 2021, Cuba ransomware partnered with the spam operators of the
Hancitor malware to gain access to corporate networks through DocuSign phishing
emails.
Since then, Cuba has evolved its operations to target public-facing services
vulnerabilities, such as the Microsoft Exchange ProxyShell and ProxyLogon
vulnerabilities.
This shift makes the attacks more potent but also easier to thwart, as security
updates that plug the exploited issues have been available for many months now.
The Cuba operation will likely turn its attention to other vulnerabilities once
there are no more valuable targets running unpatched Microsoft Exchange servers.
This means that applying the available security updates as soon as the software
vendors release them is key in maintaining a robust security stance against even
the most sophisticated threat actors.
RELATED ARTICLES:
Microsoft fixes actively exploited Exchange zero-day bugs, patch now
Microsoft Exchange targeted for IcedID reply-chain hijacking attacks
REvil ransomware member extradited to U.S. to stand trial for Kaseya attack
Microsoft March 2022 Patch Tuesday fixes 71 flaws, 3 zero-days
Hackers target Ukrainian govt with IcedID malware, Zimbra exploits
* Cuba Ransomware
* Microsoft Exchange
* ProxyLogon
* ProxyShell
* Ransomware
* Vulnerability
* Facebook
* Twitter
* LinkedIn
* Email
*
BILL TOULAS
Bill Toulas is a technology writer and infosec news reporter with over a decade
of experience working on various online publications. An open source advocate
and Linux enthusiast, is currently finding pleasure in following hacks, malware
campaigns, and data breach incidents, as well as by exploring the intricate ways
through which tech is swiftly transforming our lives.
* Previous Article
* Next Article
COMMENTS
* CODESTRADAMUS - 1 MONTH AGO
*
*
Terrible decision to refer to this as Cuba, reads terribly in areas of the
article. Otherwise the content is well put together.
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* Microsoft April 2022 Patch Tuesday fixes 119 flaws, 2 zero-days
* Windows 10 KB5012599 and KB5012591 updates released
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2022 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT