LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0625: Cuba

Cuba is a Windows-based ransomware family that has been used against financial institutions, technology, and logistics organizations in North and South America as well as Europe since at least December 2019.[1]

EnterpriseS0625MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Cuba is a Windows-based ransomware family in ATT&CK, described by MITRE as used against financial institutions, technology, and logistics organizations in North and South America and Europe since at least December 2019. Its mapped behaviors matter because they span pre-impact discovery, execution through PowerShell and Windows command shell, stealth through obfuscation and hidden execution, credential-related collection via keylogging, service manipulation, and data encryption for impact. For leaders, this is less about one malware name and more about validating whether Windows ransomware tradecraft would be visible before encryption disrupts operations.

Executive priority

Prioritize Cuba as a ransomware resilience validation case for Windows environments. The decision questions are: can the organization detect discovery and service manipulation before encryption, can IR teams reconstruct activity if files are deleted or payloads are packed/obfuscated, and are backup, service recovery, and evidence-retention processes ready for a disruptive ransomware event? The ATT&CK record supports heightened attention for sectors named in the source description—financial institutions, technology, and logistics—but local exposure should be determined from asset criticality, Windows dependency, telemetry coverage, and recovery readiness.

Technical view

The malware object has no ATT&CK-provided detection text, so SOC and detection engineering work should be driven by the mapped techniques and the Windows platform. Validate visibility for PowerShell and cmd execution, Windows service creation or modification, access token manipulation, process/service/network/share/file discovery, local storage enumeration, ingress tool transfer, hidden windows, reflective code loading, file deletion, keylogging indicators, service stops, and data encryption activity. Because several mapped behaviors are also used by administrators and legitimate software, detection should correlate sequences: discovery across services/processes/network/shares/storage followed by tool transfer or suspicious execution, service changes or stops, stealth behaviors, and encryption-like file activity.

Likely telemetry

  • Windows endpoint detection and response events for process creation, command line, parent/child process relationships, and module or memory-loading behavior
  • PowerShell logging where enabled, including script block, module, and command invocation evidence
  • Windows service control and service configuration change events
  • Windows Security events relevant to logon context, privilege use, and token-related anomalies
  • File system telemetry for high-volume file modification, encryption-like writes, suspicious renames, and file deletion

Detection direction

  • Build detections around behavior chains rather than the Cuba name alone, because ATT&CK provides no official detection guidance and the malware uses common administrative interfaces.
  • Tune discovery detections for bursts or unusual combinations of service, process, network configuration, network connection, file, directory, share, language, and storage enumeration on Windows systems.
  • Correlate PowerShell or cmd execution with subsequent tool transfer, service creation or modification, service stopping, file deletion, and encryption-like file operations.
  • Treat Windows service changes and service stop activity on critical servers as high-value ransomware precursors, while suppressing known maintenance windows and approved administrative tooling.
  • Account for stealth blind spots: packed binaries, legitimate-looking names or locations, hidden windows, native API usage, and reflective code loading can reduce reliance on simple file names, hashes, or command-line-only rules.

Mitigation priorities

  • Start with recovery resilience: tested offline or protected backups, restoration runbooks, and prioritization of critical Windows services and business systems.
  • Reduce execution and scripting risk by constraining unnecessary PowerShell and command shell use, applying least privilege, and monitoring administrative tooling rather than blocking blindly.
  • Harden Windows service control by limiting who can create, modify, or stop services and by reviewing service configurations on critical hosts.
  • Improve identity and privilege controls around administrative accounts because access token manipulation and keylogging-related behaviors increase the value of strong credential hygiene and rapid credential reset procedures.
  • Limit ransomware spread opportunities by reviewing network share exposure, SMB access, and segmentation for systems that hold critical operational data.
Additional notes and limits

This take is based on the ATT&CK S0625 Cuba malware object, its Windows platform designation, the official description, the McAfee April 2021 reference listed by MITRE, and the supplied 'uses' relationships. The mapped relationships provide useful defensive planning context even though the malware object itself does not specify tactics and does not include ATT&CK detection text.

The supplied ATT&CK fields do not provide indicators, hashes, command examples for Cuba specifically, active campaign status, victim counts, attribution, or guaranteed detection logic. Several related technique descriptions list broad platform applicability, but the malware object itself is Windows-based, so environment-specific validation should focus on Windows unless local intelligence supports more. Local telemetry, asset criticality, and incident history are required to turn this into a precise coverage assessment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Cuba

Cuba is a Windows-based ransomware family that has been used against financial institutions, technology, and logistics organizations in North and South America as well as Europe since at least December 2019.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

23 rows
DomainIDNameRelationship / procedure
EnterpriseT1680Local Storage Discovery

Cuba can enumerate local drives, disk type, and disk free space.[1]

EnterpriseT1543.003Windows ServiceSub-technique

Cuba can modify services by using the OpenService and ChangeServiceConfig functions.[1]

EnterpriseT1027.002Software PackingSub-technique

Cuba has a packed payload when delivered.[1]

EnterpriseT1106Native API

Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.[1]

EnterpriseT1614.001System Language DiscoverySub-technique

Cuba can check if Russian language is installed on the infected machine by using the function GetKeyboardLayoutList.[1]

EnterpriseT1486Data Encrypted for Impact

Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.[1]

EnterpriseT1135Network Share Discovery

Cuba can discover shared resources using the NetShareEnum API call.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Cuba has used cmd.exe /c and batch files for execution.[1]

EnterpriseT1070.004File DeletionSub-technique

Cuba can use the command cmd.exe /c del to delete its artifacts from the system.[1]

EnterpriseT1620Reflective Code Loading

Cuba loaded the payload into memory using PowerShell.[1]

EnterpriseT1059.001PowerShellSub-technique

Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.[1]

EnterpriseT1083File and Directory Discovery

Cuba can enumerate files by using a variety of functions.[1]

EnterpriseT1105Ingress Tool Transfer

Cuba can download files from its C2 server.[1]

EnterpriseT1056.001KeyloggingSub-technique

Cuba logs keystrokes via polling by using GetKeyState and VkKeyScan functions.[1]

EnterpriseT1027Obfuscated Files or Information

Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.[1]

EnterpriseT1489Service Stop

Cuba has a hardcoded list of services and processes to terminate.[1]

EnterpriseT1016System Network Configuration Discovery

Cuba can retrieve the ARP cache from the local system by using GetIpNetTable.[1]

EnterpriseT1049System Network Connections Discovery

Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.[1]

EnterpriseT1007System Service Discovery

Cuba can query service status using QueryServiceStatusEx function.[1]

EnterpriseT1057Process Discovery

Cuba can enumerate processes running on a victim's machine.[1]

EnterpriseT1134Access Token Manipulation

Cuba has used SeDebugPrivilege and AdjustTokenPrivileges to elevate privileges.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.[1]

EnterpriseT1564.003Hidden WindowSub-technique

Cuba has executed hidden PowerShell windows.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1614.001: System Language DiscoveryEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1620: Reflective Code LoadingEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1489: Service StopEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1134: Access Token ManipulationEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
0fb4b28cc17df600...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle0fb4b28cc17d…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  2. [2]
    Cuba

    (Citation: McAfee Cuba April 2021)

  3. [3]
    Cuba

    (Citation: McAfee Cuba April 2021)

  4. [4]
    Cuba

    (Citation: McAfee Cuba April 2021)

  5. [5]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  6. [6]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  7. [7]
    mitre-attackS0625
    Open source URL
  8. [8]
    mitre-attackS0625
    Open source URL
  9. [9]
    mitre-attackS0625
    Open source URL
  10. [10]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  11. [11]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  12. [12]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  13. [13]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  14. [14]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  15. [15]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  16. [16]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  17. [17]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  18. [18]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  19. [19]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  20. [20]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  21. [21]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  22. [22]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  23. [23]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  24. [24]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  25. [25]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  26. [26]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  27. [27]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  28. [28]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  29. [29]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  30. [30]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  31. [31]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  32. [32]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  33. [33]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  34. [34]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  35. [35]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  36. [36]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  37. [37]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  38. [38]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  39. [39]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  40. [40]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  41. [41]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  42. [42]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  43. [43]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  44. [44]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  45. [45]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  46. [46]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  47. [47]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  48. [48]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  49. [49]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  50. [50]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  51. [51]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  52. [52]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
  53. [53]
    McAfee Cuba April 2021

    Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use