BlackBerry’s Threat Research and Intelligence team have details on a ransomware gang called Cuba that is using a number of new and old tools to go after US and Latin American targets:
Cuba ransomware is currently into the fourth year of its operation and shows no sign of slowing down. In the first half of 2023 alone, the operators behind Cuba ransomware were the perpetrators of several high-profile attacks across disparate industries.
The BlackBerry Threat Research and Intelligence team investigated a campaign by this threat group conducted in June that culminated in attacks on an organization within the critical infrastructure sector in the United States, and also on an IT integrator in Latin America. The Cuba threat group, believed to be of Russian origin, deployed a set of malicious tools that overlapped with previous campaigns associated with this attacker, as well as introducing new ones — including the first observed use of an exploit for the Veeam vulnerability CVE-2023-27532.Note that prior to the publication of this report, BlackBerry shared this information privately with the relevant authorities, to support security and resilience across organizations worldwide.
And who are they? BlackBerry can help you with that:
Cuba ransomware, also known as COLDDRAW ransomware, first appeared on the threat landscape in 2019 and has built up a relatively small but carefully selected list of victims in the years since. It is also known as Fidel ransomware, due to a characteristic marker placed at the beginning of all encrypted files. This file marker is used as an indicator to both the ransomware and its decoder that the file has been encrypted.
Despite its name and the Cuban nationalistic styling on its leak site, it unlikely has any connection or affiliation with the Republic of Cuba. It has previously been linked to a Russian-speaking threat actor by researchers at Profero due to some linguistic mistranslation details they uncovered, as well as the discovery of a 404 webpage containing Russian text on the threat actor’s own leak site.Based on the strings analysis of the code used in this campaign, we also found indications that the developer behind Cuba ransomware is Russian-speaking. That theory is further strengthened by the fact the ransomware automatically terminates its own execution on hosts that are set to the Russian language, or on those that have the Russian keyboard layout present.
Lovely. Another group of Russian threat actors to worry about. The BlackBerry report has a lot of detail about this group and how to not become one of their victims. It’s very much worth reading and implementing their recommendations.

Elon Musk #Fails Again As Twitter Posts Before December 2014 Have Their Links Or Images Deleted
Posted in Commentary with tags Twitter on August 21, 2023 by itnerdJust when you think Elon Musk can’t find any new ways to make X/Twitter any worse than it already is, he surprises you and does just that. In this case according to The Verge, if you have a Twitter post before December 2014 apparently have had any links or Images in them deleted:
X, which was formerly known as Twitter until its recent rebranding, is having a problem displaying old posts that came with images attached or any hyperlinks converted through Twitter’s built-in URL shortener. It’s unclear when the problem started, but it was highlighted on Saturday afternoon in a post by Tom Coates, and a Brazilian vtuber, @DaniloTakagi, had pointed it out a couple of days earlier.
As it is, it appears to affect tweets published prior to December 2014, judging by posts visible on my own account. No videos are affected (Twitter only added native image support in 2011 and built-in videos in 2016), but links to YouTube, for example, are now just text with a t.co URL that doesn’t work.
On Saturday afternoon, as Coates pointed out, the glitch claimed the picture from one of the most famous tweets ever (back when they were still called tweets), this selfie posted by 2014 Oscars host Ellen DeGeneres flanked by celebs like Bradley Cooper, Jennifer Lawrence, and others, taken during the show’s broadcast. It quickly became the “most retweeted ever,” with over 2 million shares on the platform.
I haven’t seen any public comments from owner Elon Musk or X CEO Linda Yaccarino about the problem, but at some point on Saturday night / early Sunday morning, the picture in that post was restored.
Despite speculation that it could be an intentional cost-cutting move by Musk, the fact that the actual media posted hasn’t been deleted suggests an error or bug of some kind, one of many that have arisen since last year’s takeover and mass layoffs.
First of all you’re not going to see any comment from Elon or Yaccarino on this or anything else that goes wrong with Twitter/X as that would force them to admit that Twitter is broken. Which they won’t ever do. I am going to assume that now that this is out in the public domain, this will get fixed somehow. But it illustrates how unstable the platform is. And if the rampant hate along with Elon’s “ready, fire, aim” mentality isn’t enough to make you run from Twitter, this is another reason to get off the platform.
2 Comments »