Novel News on Cuba Ransomware: Greetings From Tropical Scorpius
Summary: Unit 42 observed the threat actor it tracks as Tropical Scorpius deploying Cuba Ransomware from early May 2022 using new tools, including an unsigned dropper that writes a kernel driver called ApcHelper.sys to terminate security products, with the driver signed using a certificate from the LAPSUS NVIDIA leak. The group has used Cuba Ransomware against 27 additional organizations as of July 2022 across sectors including government, manufacturing, health care and energy, bringing the total exposed on its leak site to 60 since the family first surfaced in December 2019, and the FBI says the gang has made at least $43.9 million from ransom payments while demanding at least $74 million.
What's compelling: A signed kernel driver built to kill security products, signed with a stolen LAPSUS NVIDIA certificate, means endpoint protection can be disabled from inside the kernel before encryption starts, and the FBI's $43.9 million figure shows the model is paying for the group.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026