Activity related to the Cuba Ransomware Gang has increased in the past several weeks after security researchers uncovered an ongoing campaign from associated threat actors targeting United States critical infrastructure. The Cuba Ransomware Gang, also known as Fidel/COLDDRAW ransomware, has been active in the threat landscape since 2019 and specializes in the compromise and exploitation of organizations throughout Ukraine, Latin America, and more recently the United States. These actors follow in the footsteps of many modern ransomware operations by implementing double-extortion tactics in their attacks. Malicious payloads often deployed in Cuba Ransomware attacks include the “RomCom” remote access trojan (RAT) and “Industrial Spy” malware. In a recent campaign, Cuba Ransomware actors have been observed compromising organizations through a vulnerability within Veeam Backup & Replication products, tracked as CVE-2023-27532. This vulnerability allows threat actors to access the encrypted credential listing within the configuration database of Veeam products. According to security researchers, Cuba Ransomware has attempted to compromise a critical infrastructure organization within the United States through the Veeam vulnerability. Additional technical details of the recent Cuba Ransomware campaign, including detailed malware analysis, tactics, and techniques are provided in the reports below. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.