Cuba ransomware uses Veeam exploit against critical U.S. organizations
![Image](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxSwpB51E6-AUv9fJcL8BsuNC9JG23PYA36gVr1C2kXZN_vIg15bnPKXyfADP6cTcSssDbxT-fzn3KCJHk-7SyF1FqYEbxK4QCyh-M8FpL-eI6NjIhbTBUUuADJJhJksWrmD23FtCzRNem2z1nQVSooDkwXfT_iH1TwgP9SOSeT9dSEzqINZ9cyxJkjPU/w640-h360/Cuba-2.jpg)
The Cuba ransomware gang was observed in attacks targeting critical infrastructure organizations in the United States and IT firms in Latin America, using a combination of old and new tools. BlackBerry's Threat Research and Intelligence team, which spotted the latest campaign in early June 2023, reports that Cuba now leverages CVE-2023-27532 to steal credentials from configuration files. The particular flaw impacts Veeam Backup & Replication (VBR) products, and an exploit for it has been available since March 2023. Previously, WithSecure reported that FIN7, a group with multiple confirmed affiliations with various ransomware operations, was actively exploiting CVE-2023-27532. Cuba attack details BlackBerry reports that Cuba's initial access vector appears to be compromised admin credentials via RDP, not involving brute forcing. Next, Cuba's signature custom downloader 'BugHatch' establishes communication with the C2 server and downloads DLL files or executes c