H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Cuba](https://attack.mitre.org/software/S0625) is a Windows-based ransomware family that has been used against financial institutions, technology, and logistics organizations in North and South America as well as Europe since at least December 2019.(Citation: McAfee Cuba April 2021)

Labels

malware

23 recorded

Relationships

uses

to Access Token Manipulation

Technique

uses

to Data Encrypted for Impact

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Hidden Window

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Local Storage Discovery

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Technique

uses

to Network Share Discovery

Technique

uses

to Obfuscated Files or Information

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Reflective Code Loading

Technique

uses

to Service Stop

Technique

uses

to Software Packing

Technique

uses

to System Language Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

3 external

References

mitre-attack

S0625

Cuba

—

McAfee Cuba April 2021

https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf