Schneier on Security

Clive Robinson • September 2, 2022 9:46 AM

@ Bruce, ALL,

Russia is being blamed, but I haven’t seen any evidence other than “they’re the obvious perpetrator.”

Have a look at a regional map and consider that one objective of Russia is to stop food export…

Yes Montenegro is tiny but also not in the EuroZone, both of which are to Russia’s advantage, but it also has ports into the Mediterranean just a short distance from Eastetn Italy, and two country hops from the Ukraine.

I can see reasons why “the panty poisoner” would consider it a target to try and bolster some status.

After all if you are a very vain and narcissistic adult who is angry because they’ve been kicked back by a six year old in a playground, you are going to go “kicking cradles” to prove you are a man…

Clive Robinson • September 2, 2022 2:21 PM

@ Winter, MarkH,

“Being close to Putin is a bit like being close to Stalin”

Or trying to barbeque a whole pig on an active volcano in a Luau pit…

You know it’s going to blow, you just do not know when or how, you just hope you “get to fill your boots” and make a strategic exit before the rocks become ash falling from above.

The thing is the panty poisoner can only keep cutting back on top manpower like he’s been doing for so long… Before some will realise they will all be better off without him and remove their immedeate threat out of self defence. Then the real problems will start, such power struggles rarely go quietly, especially when street thug machismo is more prevalent than rational educated thought.

It will be of mild interest to see how many of the 6000 survive the comming storm.

Clive Robinson • September 3, 2022 4:49 PM

@ Ted,

“They’re now thinking it’s the Cuba Ransomware group – a cybercriminal group that may have Russian members.”

You need to dig a little deeper into the relationship between Cuba and Russia.

Russia was at one point “renting” a lot of Cuba, for the likes of “Numbers Stations” etc, and thus sourced Cuba a lot of it’s foreign hard currency.

Russia did a nose dive economy wise and stopped “renting”. Well in recent years the “renting” has started up again.

So I would suspect the “Cuba Ransomware group” is just using an “accommodation address” maybe set up as a few “Dachas”[1] and the like, for certain “factory” people to ease a Petergrad winter out of their bones etc, maybe even a training school[2].

[1] Dacha actually means “to give” and from the mid 1800’s became associated with the Aristocracy holding entertainments and the like at “homes away from homes” like hunting lodges and larger. The term carried over into the supposed Communist era and was used for “holiday camps” for notable workers and their families. As well as being actual holiday homes “given” by the State to leaders and other notables. Which is why people sometimrs think Dacha means “holiday home”, something a number of Spy Novels alluded to.

[2] The KGB had a lot of such “training schools” around the world where those who showed the right sort of promise were sent to “learn the culture” etc so they could later fit in. Both Cuba and Brazil were good places to start learning the culture that is common in South West Europe. Thus give an effective back story when in other parts of Europe, picking up more culture as it were. Including “British” and “German” from holiday makers.

Clive Robinson • September 4, 2022 1:49 AM

@ Ted,

Re : Cuba Ransomware

It has a history going back to 2019 atleast.

An important point it had was the “Don’t upset Putin” look for a Russian Keyboard and if found die code.

But also the areas it was focussed on of Latin America, North America[1], Spain, Germany, and other European countries,

”’ps://lab52.io/blog/cuba-ransomware-analysis/

Also the attacks appear to be seasonal not continuous, which suggests that the attackers are modal for some reason and may be running campaigns for others

”’ps://www.trendmicro.com/en_us/research/22/f/cuba-ransomware-group-s-new-variant-found-using-optimized-infect.html

There is other info out there, but as always attribution based just on captured software can be hard.

[1] The most prominent North American attack to hit the news was on the “Automatic Funds Transfer Services”(AFTS) based in Seattle. They did not pay the ransom asked for on their exfiltrated data. Which resulted in it appearing on the ransomware operators Dark Web servers where it was traded. As a payment processing service aimed at the likes of state government, municipal and similar entities in Washington and throughout the United States, AFTS hold a lot of Private Personal Information”(PPI). With respect to PPI the ransomware operators also aquired he details of probably 38 million people from the California Department of Motor Vehicles. Which also turned up being Dark Web traded, presumably to be used for identity theft and similar purposes. One of which as the data obtained where the names, addresses, phone numbers, credit card information, and similar could be to build a data base of persons of interest to target for various reasons. Of the fifty or so known organisations attacked they have been mainly the government, financial, manufacturing, healthcare, and ICT industries. Which have been the traditional and more recent targets for Russian State or state aligned attackers.