// THREAT ACTOR
CUBA_
DormantCUBA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of CUBA — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2024 2
- 2023 18
- 2022 73
- 2021 12
Leak site mirrors
4 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
cuba4mp6ximo2zlo.onionCuba snapshot · 2022-08-28 10:03 -
cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onionCuba snapshot · 2024-02-08 11:10 -
i34gbmo5rxx3bxc4yl7f4erkyo2oldwavhpdragnjjvhni6fwvptp2id.onionsnapshot · 2024-12-11 12:06 -
kcfgfs7cclscxloy3bf2xtwnayimawtzrbfirfbvl47xt7n2brfiizyd.onionsnapshot · 2025-01-25 02:46
Recent victims
The 50 most recent victims claimed by CUBA. Total in the index: 105.
| Date listed | Victim | Description |
|---|---|---|
| 2024-02-01 | dms-imaging | |
| 2024-01-22 | deknudtframes.be | |
| 2023-11-14 | diagnostechs | |
| 2023-11-13 | portadelaidefc | |
| 2023-11-07 | panaya | |
| 2023-11-07 | prime-art | |
| 2023-10-23 | Newconcepttech | |
| 2023-10-10 | mountstmarys | |
| 2023-10-03 | co.rock.wi.us | |
| 2023-08-19 | goldmedalbakery | |
| 2023-07-31 | hydrex.co.uk | |
| 2023-07-31 | txmplant.co.uk | |
| 2023-07-11 | gis4.addison-il | |
| 2023-05-23 | Inquirer | |
| 2023-05-10 | Vdi | |
| 2023-05-04 | 2networkit | |
| 2023-05-04 | Sae-a | |
| 2023-05-04 | pu.edu.lb | |
| 2023-05-04 | Gihealthcare | |
| 2023-05-04 | cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion | |
| 2022-12-02 | learning_resources | |
| 2022-12-02 | usairports | |
| 2022-12-02 | first_coast_logistics_services | |
| 2022-12-02 | e.h._wachs_pipe_cutters | |
| 2022-12-02 | datamatics | |
| 2022-12-02 | the_rose_executive_team | |
| 2022-12-02 | afts | |
| 2022-12-02 | otrcapital | |
| 2022-12-02 | forefront_dermatology | |
| 2022-12-02 | innovairre | |
| 2022-12-02 | megaforce | |
| 2022-12-02 | gascaribe | |
| 2022-12-02 | quercus | |
| 2022-12-02 | blackhawk | |
| 2022-12-02 | lycra | |
| 2022-12-02 | technicote | |
| 2022-12-02 | berding-weil | |
| 2022-12-02 | nwdusa | |
| 2022-12-02 | creditriskmonitor | |
| 2022-12-02 | linkmfg | |
| 2022-12-02 | axley | |
| 2022-12-02 | schultheis-ins | |
| 2022-12-02 | meriplex | |
| 2022-12-02 | ohagin | |
| 2022-12-02 | landofrost | |
| 2022-12-02 | ncmutuallife2 | |
| 2022-12-02 | get-integrated | |
| 2022-12-02 | trant.co.uk | |
| 2022-12-02 | bcintlgroup.com | |
| 2022-12-02 | stm.com.tw |