cuba
Also known as: ColddrawFirst seen February 3, 2021Active103 claimed victims
The claims below are reproduced as posted by cuba on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Cuba Ransomware, also known as Colddraw Ransomware, was first identified in the threat landscape in 2019 and built a relatively small but selected list of victims. The group is also known as Fidel Ransomware, due to a characteristic marker placed at the beginning of all encrypted files. This file marker is used as an indicator for the ransomware and its decoder that the file has been encrypted. Despite its name and the Cuban nationalist style on its leak site, it is difficult to assert any connection or affiliation with the Republic of Cuba.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| dms-imaging | February 1, 2024 | ransomware_live | — |
| deknudtframes.be | January 18, 2024 | ransomware_live | — |
| diagnostechs | November 14, 2023 | ransomware_live | — |
| portadelaidefc | November 13, 2023 | ransomware_live | — |
| prime-art | November 7, 2023 | ransomware_live | — |
| panaya | November 7, 2023 | ransomware_live | — |
| Newconcepttech | October 23, 2023 | ransomware_live | — |
| mountstmarys | October 10, 2023 | ransomware_live | — |
| co.rock.wi.us | October 3, 2023 | ransomware_live | — |
| goldmedalbakery | August 19, 2023 | ransomware_live | — |
| txmplant.co.uk | July 31, 2023 | ransomware_live | — |
| hydrex.co.uk | July 31, 2023 | ransomware_live | — |
| gis4.addison-il | July 11, 2023 | ransomware_live | — |
| Inquirer | May 23, 2023 | ransomware_live | — |
| Vdi | May 10, 2023 | ransomware_live | — |
| Gihealthcare | May 4, 2023 | ransomware_live | — |
| pu.edu.lb | December 27, 2022 | ransomware_live | — |
| Sae-a | December 20, 2022 | ransomware_live | — |
| 2networkit | December 12, 2022 | ransomware_live | — |
| Boss-inc | December 1, 2022 | ransomware_live | — |
| Generator-power | December 1, 2022 | ransomware_live | — |
| Landaumedia | December 1, 2022 | ransomware_live | — |
| Patton | November 30, 2022 | ransomware_live | — |
| Pmc-group | November 24, 2022 | ransomware_live | — |
| waltersandwolf | November 9, 2022 | ransomware_live | — |
| afts | November 4, 2022 | ransomware_live | — |
| axley | November 4, 2022 | ransomware_live | — |
| bcintlgroup.com | November 4, 2022 | ransomware_live | — |
| berding-weil | November 4, 2022 | ransomware_live | — |
| blackhawk | November 4, 2022 | ransomware_live | — |
| creditriskmonitor | November 4, 2022 | ransomware_live | — |
| datamatics | November 4, 2022 | ransomware_live | — |
| e.h._wachs_pipe_cutters | November 4, 2022 | ransomware_live | — |
| first_coast_logistics_services | November 4, 2022 | ransomware_live | — |
| forefront_dermatology | November 4, 2022 | ransomware_live | — |
| gascaribe | November 4, 2022 | ransomware_live | — |
| get-integrated | November 4, 2022 | ransomware_live | — |
| innovairre | November 4, 2022 | ransomware_live | — |
| landofrost | November 4, 2022 | ransomware_live | — |
| learning_resources | November 4, 2022 | ransomware_live | — |
| linkmfg | November 4, 2022 | ransomware_live | — |
| lycra | November 4, 2022 | ransomware_live | — |
| megaforce | November 4, 2022 | ransomware_live | — |
| meriplex | November 4, 2022 | ransomware_live | — |
| ncmutuallife2 | November 4, 2022 | ransomware_live | — |
| nwdusa | November 4, 2022 | ransomware_live | — |
| ohagin | November 4, 2022 | ransomware_live | — |
| otrcapital | November 4, 2022 | ransomware_live | — |
| quercus | November 4, 2022 | ransomware_live | — |
| schultheis-ins | November 4, 2022 | ransomware_live | — |
| site-technology_ | November 4, 2022 | ransomware_live | — |
| stm.com.tw | November 4, 2022 | ransomware_live | — |
| technicote | November 4, 2022 | ransomware_live | — |
| the_rose_executive_team | November 4, 2022 | ransomware_live | — |
| trant.co.uk | November 4, 2022 | ransomware_live | — |
| usairports | November 4, 2022 | ransomware_live | — |
| Dialogsas | November 4, 2022 | ransomware_live | — |
| Murphyfamilyventures | November 4, 2022 | ransomware_live | — |
| Ville-chaville | November 4, 2022 | ransomware_live | — |
| bfw | November 4, 2022 | ransomware_live | — |
| ginspectionservices | September 27, 2022 | ransomware_live | — |
| skupstina | August 30, 2022 | ransomware_live | — |
| site-technology | July 21, 2022 | ransomware_live | — |
| stm-com-tw | July 7, 2022 | ransomware_live | — |
| r1group | June 27, 2022 | ransomware_live | — |
| etron | June 13, 2022 | ransomware_live | — |
| upskwt | May 17, 2022 | ransomware_live | — |
| fronteousa | May 16, 2022 | ransomware_live | — |
| metrobrokers | April 22, 2022 | ransomware_live | — |
| prophoenix | April 22, 2022 | ransomware_live | — |
| tavistock | April 12, 2022 | ransomware_live | — |
| metagenics | April 8, 2022 | ransomware_live | — |
| trant-co-uk | March 30, 2022 | ransomware_live | — |
| bcintlgroup-com | March 30, 2022 | ransomware_live | — |
| powertech | March 23, 2022 | ransomware_live | — |
| haltonhills | March 23, 2022 | ransomware_live | — |
| ids97 | February 25, 2022 | ransomware_live | — |
| heritage-encon | February 18, 2022 | ransomware_live | — |
| muntons | February 18, 2022 | ransomware_live | — |
| cmmcpas | February 4, 2022 | ransomware_live | — |
| edgo | February 4, 2022 | ransomware_live | — |
| shoesforcrews | February 4, 2022 | ransomware_live | — |
| mtlcraft | January 25, 2022 | ransomware_live | — |
| fdcbuilding | January 13, 2022 | ransomware_live | — |
| superfund | January 13, 2022 | ransomware_live | — |
| cle | January 10, 2022 | ransomware_live | — |
| delinebox | January 10, 2022 | ransomware_live | — |
| regulvar | January 10, 2022 | ransomware_live | — |
| sonomatic-2 | January 10, 2022 | ransomware_live | — |
| strongwell | January 10, 2022 | ransomware_live | — |
| atlasdie | December 30, 2021 | ransomware_live | — |
| bakertilly | December 30, 2021 | ransomware_live | — |
| lahebert | December 30, 2021 | ransomware_live | — |
| ncmutuallife | December 30, 2021 | ransomware_live | — |
| sonomatic | December 30, 2021 | ransomware_live | — |
| squamish | December 30, 2021 | ransomware_live | — |
| OTR Capital believes in simple and straightforward transactions, without hidden costs and | September 9, 2021 | ransomware_live | — |
| AFTS supplies the preeminent Payment Processing, IRS 1031 Exchange, Data Processing, Invoi | September 9, 2021 | ransomware_live | — |
| Rose Associates Mission Statement | September 9, 2021 | ransomware_live | — |
| Datamatics is a technology company that builds intelligent solutions enabling data-driven | September 9, 2021 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).