Tech & Innovation in Healthcare

On Dec. 1, 2022, the Federal Bureau of Investigation (FBI) and the Cybersecurity & Infrastructure Security Agency (CISA) issued a joint cybersecurity advisory (CSA) updating a December 2021 FBI Flash regarding Cuba ransomware. The agencies provided additional information about how threat actors have adjusted how they unleash the ransomware on entities.

Important: The threat is known in the industry as Cuba ransomware, but at the time of publication, there is no known connection between the ransomware threat actors and the Republic of Cuba.

Background: In 2021, the FBI detected threat actors using Cuba ransomware to target different U.S. entities in five key infrastructure sectors, including healthcare and public health.

Cuba ransomware threat actors used the following tactics to leverage systems:

• Phishing;
• Using compromised credentials;
• Taking control of remote desktop protocol (RDP) tools; and
• Exploiting commercial software known vulnerabilities.

Since the original announcements, systems affected by Cuba ransomware have doubled in the U.S., and as of August 2022, threat actors have:

• Seized control of 101 entities, including 65 within the U.S.
• Demanded $145 million in ransom.
• Received $60 million in ransom payments.

According to the CSA, “third-party and open-source reports have identified a possible link between Cuba ransomware actors, RomCom Remote Access Trojan (RAT) actors, and Industrial Spy ransomware actors.”

Since spring 2022, threat actors have made changes to their tactics, techniques, and procedures (TTPs) and tools to compromise networks and seek payments from their victims. Threat actors have deployed ransomware, but they also have implemented “double extortion” techniques. The double extortion techniques begin by stealing the victim’s data and then the threat actors demand a ransom payment to decrypt the data, and finally threaten to release the data publicly if the ransom isn’t paid.

The FBI and CISA provided mitigation recommendations in the CSA to “limit potential adversarial use of common system and network discovery techniques to reduce the risk of compromise by Cuba ransomware.”