malware family

Cuba

unknownentity:malware_familyransomware · 1 source

The Cuba Ransomware, also known as Colddraw Ransomware, was first identified in the threat landscape in 2019 and built a relatively small but selected list of victims. The group is also known as Fidel Ransomware, due to a characteristic marker placed at the beginning of all encrypted files. This file marker is used as an indicator for the ransomware and its decoder that the file has been encrypted.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: cuba
kind: malware family
status: unknown
aliases: COLDDRAW · Fidel
jurisdictions: —
claims naming it: 36 · 0 attributions · 0 relations · 0 events

Identifiers

attack S0625via mitre-attack
misp-galaxy 82ed1669-89ba-4432-bc97-148a25c15fdfvia misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 20 of 36

Cubaransomwarepayment
subjecttransactiond924c8fd16…07df5c3953
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1q6rsj3cn37dngypu5kad9gdw5ykhctpwhjvun3z · 12,743,399 sat · time 2022-04-27 22:04 UTC · url https://ransomwhe.re/#address/bc1q6rsj3cn37dngypu5kad9gdw5ykhctpwhjvun3z
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27057btcintel:annotations:27057@v3 sha256:ed8d7ff6f45661bc
confidencetrusted provider · 50
Cubaransomwarepayment
subjecttransaction29bb036006…cc531e56b2
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1q6rsj3cn37dngypu5kad9gdw5ykhctpwhjvun3z · 25,413,379,133 sat · time 2022-04-27 22:55 UTC · url https://ransomwhe.re/#address/bc1q6rsj3cn37dngypu5kad9gdw5ykhctpwhjvun3z
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27056btcintel:annotations:27056@v3 sha256:1c20ab0f4ca132c6
confidencetrusted provider · 50
Cubaransomwarepayment address
subjectaddressbc1q6rsj3cn37dngypu5kad9gdw5ykhctpwhjvun3z
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Cuba · url https://ransomwhe.re/#address/bc1q6rsj3cn37dngypu5kad9gdw5ykhctpwhjvun3z
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_27055btcintel:annotations:27055@v2 sha256:0ffee728f7dcdfa7
confidencetrusted provider · 50
Cubaransomwarepayment
subjecttransaction1a61862ac0…daa6aac8f3
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qs3lv77udkap2enxv928x59yuact5df4t95rsqr · 2,600,097,052 sat · time 2020-02-27 17:11 UTC · url https://ransomwhe.re/#address/bc1qs3lv77udkap2enxv928x59yuact5df4t95rsqr
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27054btcintel:annotations:27054@v3 sha256:7ef1d50a37af389d
confidencetrusted provider · 50
Cubaransomwarepayment address
subjectaddressbc1qs3lv77udkap2enxv928x59yuact5df4t95rsqr
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Cuba · url https://ransomwhe.re/#address/bc1qs3lv77udkap2enxv928x59yuact5df4t95rsqr
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_27053btcintel:annotations:27053@v2 sha256:e2635dc0cd5f97e6
confidencetrusted provider · 50
Cubaransomwarepayment
subjecttransaction3836b76a17…c5132a9b85
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qyd05q2m5qt3nwpd3gcqkyer0gspqx5p6evcf7h · 3,797,075,612 sat · time 2020-05-24 14:08 UTC · url https://ransomwhe.re/#address/bc1qyd05q2m5qt3nwpd3gcqkyer0gspqx5p6evcf7h
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27052btcintel:annotations:27052@v3 sha256:cf55535ea7ffb237
confidencetrusted provider · 50
Cubaransomwarepayment address
subjectaddressbc1qyd05q2m5qt3nwpd3gcqkyer0gspqx5p6evcf7h
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Cuba · url https://ransomwhe.re/#address/bc1qyd05q2m5qt3nwpd3gcqkyer0gspqx5p6evcf7h
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_27051btcintel:annotations:27051@v2 sha256:7ad68b50a404c9bb
confidencetrusted provider · 50
Cubaransomwarepayment
subjecttransactione73e693ce9…a8299baad7
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qhpepeeh7hlz5jvrp50uhkz59lhakcfvme0w9qh · 5,132,000,000 sat · time 2020-07-25 21:20 UTC · url https://ransomwhe.re/#address/bc1qhpepeeh7hlz5jvrp50uhkz59lhakcfvme0w9qh
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27050btcintel:annotations:27050@v3 sha256:19d523a5b0b4b200
confidencetrusted provider · 50
Cubaransomwarepayment address
subjectaddressbc1qhpepeeh7hlz5jvrp50uhkz59lhakcfvme0w9qh
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Cuba · url https://ransomwhe.re/#address/bc1qhpepeeh7hlz5jvrp50uhkz59lhakcfvme0w9qh
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_27049btcintel:annotations:27049@v2 sha256:93bb2cbf035a7437
confidencetrusted provider · 50
Cubaransomwarepayment
subjecttransactiond15969a966…46272cf84c
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qp7h9fszlqxjwyfhv0upparnsgx56x7v7wfx4x7 · 3,779,344,406 sat · time 2020-12-08 16:13 UTC · url https://ransomwhe.re/#address/bc1qp7h9fszlqxjwyfhv0upparnsgx56x7v7wfx4x7
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27048btcintel:annotations:27048@v3 sha256:7ebd5a5bd6598dec
confidencetrusted provider · 50
Cubaransomwarepayment address
subjectaddressbc1qp7h9fszlqxjwyfhv0upparnsgx56x7v7wfx4x7
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Cuba · url https://ransomwhe.re/#address/bc1qp7h9fszlqxjwyfhv0upparnsgx56x7v7wfx4x7
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_27047btcintel:annotations:27047@v2 sha256:7f3e2f3d324891b9
confidencetrusted provider · 50
Cubaransomwarepayment
subjecttransaction374e7aa78b…98f9d71d87
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qvpk8ksl3my6kjezjss9p28cqj4dmpmmjx5yl3y · 14,100,000,000 sat · time 2021-04-03 22:09 UTC · url https://ransomwhe.re/#address/bc1qvpk8ksl3my6kjezjss9p28cqj4dmpmmjx5yl3y
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27046btcintel:annotations:27046@v3 sha256:3fc98746137a9649
confidencetrusted provider · 50
Cubaransomwarepayment address
subjectaddressbc1qvpk8ksl3my6kjezjss9p28cqj4dmpmmjx5yl3y
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Cuba · url https://ransomwhe.re/#address/bc1qvpk8ksl3my6kjezjss9p28cqj4dmpmmjx5yl3y
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_27045btcintel:annotations:27045@v2 sha256:12961004607f6376
confidencetrusted provider · 50
Cubaransomwarepayment
subjecttransaction91a534efc1…68ae8ef24a
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1q9cj0n9k2m282x0nzj6lhqjvhkkd4h95sewek83 · 5,004,000,000 sat · time 2021-11-10 23:42 UTC · url https://ransomwhe.re/#address/bc1q9cj0n9k2m282x0nzj6lhqjvhkkd4h95sewek83
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27044btcintel:annotations:27044@v3 sha256:8e375d2b979cce49
confidencetrusted provider · 50
Cubaransomwarepayment address
subjectaddressbc1q9cj0n9k2m282x0nzj6lhqjvhkkd4h95sewek83
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Cuba · url https://ransomwhe.re/#address/bc1q9cj0n9k2m282x0nzj6lhqjvhkkd4h95sewek83
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_27043btcintel:annotations:27043@v2 sha256:e8e71d9230b1e0b8
confidencetrusted provider · 50
Cubaransomwarepayment
subjecttransaction6bc37bd391…2e99dd1def
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qft3s53ur5uq5ru6sl3zyr247dpr55mnggwucd3 · 31,811,936,268 sat · time 2020-10-30 02:07 UTC · url https://ransomwhe.re/#address/bc1qft3s53ur5uq5ru6sl3zyr247dpr55mnggwucd3
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27042btcintel:annotations:27042@v3 sha256:ac4048e0ae0ed286
confidencetrusted provider · 50
Cubaransomwarepayment address
subjectaddressbc1qft3s53ur5uq5ru6sl3zyr247dpr55mnggwucd3
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Cuba · url https://ransomwhe.re/#address/bc1qft3s53ur5uq5ru6sl3zyr247dpr55mnggwucd3
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_27041btcintel:annotations:27041@v2 sha256:97c9879cddde59e1
confidencetrusted provider · 50
Cubaransomwarepayment
subjecttransactionc2bbd82614…06739af2dd
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qc48q628t93xwzljtvurpqhcvahvesadpwqtsza · 209,001,985 sat · time 2021-10-19 21:43 UTC · url https://ransomwhe.re/#address/bc1qc48q628t93xwzljtvurpqhcvahvesadpwqtsza
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27040btcintel:annotations:27040@v3 sha256:b434e84b08f42eb9
confidencetrusted provider · 50
Cubaransomwarepayment address
subjectaddressbc1qc48q628t93xwzljtvurpqhcvahvesadpwqtsza
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Cuba · url https://ransomwhe.re/#address/bc1qc48q628t93xwzljtvurpqhcvahvesadpwqtsza
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_27039btcintel:annotations:27039@v2 sha256:90c03a1e9dad1a8b
confidencetrusted provider · 50
Cubaransomwarepayment
subjecttransactionce8b2eb291…1f9c86d9ff
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qr9l0gcl0nvmngap6ueyy5gqdwvm34kdmtevjyx · 7,142,750,245 sat · time 2021-10-14 21:51 UTC · url https://ransomwhe.re/#address/bc1qr9l0gcl0nvmngap6ueyy5gqdwvm34kdmtevjyx
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27038btcintel:annotations:27038@v3 sha256:92e342d551623706
confidencetrusted provider · 50

Subjects36 subjects carry a claim naming this entity · a sample

bc1q4vr25xkth35qslenqwd7aw020w85qrvlrhv7hcaddress
bc1q5uc0fdnz0ve5pg4nl4upa9ly586t6wmnghfe7xaddress
bc1q6rsj3cn37dngypu5kad9gdw5ykhctpwhjvun3zaddress
bc1q6zkemtyyrre2mkk23g93zyq98ygrygvx7z2q0taddress
bc1q9cj0n9k2m282x0nzj6lhqjvhkkd4h95sewek83address
bc1qaselp9nhejc3safcq3vn5wautx6w33x0llk7dladdress
bc1qc48q628t93xwzljtvurpqhcvahvesadpwqtszaaddress
bc1qft3s53ur5uq5ru6sl3zyr247dpr55mnggwucd3address
bc1qgsuf5m9tgxuv4ylxcmx8eeqn3wmlmu7f49zkusaddress
bc1qhpepeeh7hlz5jvrp50uhkz59lhakcfvme0w9qhaddress

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.