Cuba ransomware behind The Philadelphia Inquirer attack

Cuba ransomware likely behind The Philadelphia Inquirer attack

Published: 23 May 2023

Last updated: 25 May 2023

Vilius Petkauskas
Deputy Editor

Inquirer Cuba ransomware — Image by Cybernews.

The Philadelphia Inquirer, Pennsylvania’s largest news organization, was listed on the Cuba ransomware gang’s dark web blog, where crooks showcase their victims.

The notorious Cuba ransomware gang, known for its crippling attack against the Montenegro government’s digital infrastructure, was supposedly behind an incident that severely impacted The Philadelphia Inquirer newsroom earlier this month.

The gang listed the Inquirer on its dark web blog, claiming that its affiliates stole data on May 12th. According to the post, the attackers took a variety of sensitive data ranging from financial documents to source code.

Source code leaks pose significant security threats to developers as their intellectual property can be exposed. Source code exposures can also allow attackers to scrutinize security threats of apps and develop tailor-made exploits for later use.

Cuba ransomware claims — The Inquirer on Cuba's dark web blog. Image by Cybernews.

Cuba ransomware’s claims were first reported by security researcher Dominic Alvieri.

The Inquirer noticed something wrong with its IT systems on May 13th, when its staff couldn’t access its content-management system, a critical tool for publishing news stories. After discovering a breach, the company took down its IT systems and successfully found a workaround to post news stories online.

According to the Inquirer, the recent disruption is the largest since 1996, when the paper’s operations were shut down due to a major blizzard. The company said that it had notified the FBI’s Philly office about the incident.

While experts refrain from linking Cuba ransomware with the Kremlin, researchers who analyzed victim negotiations with Cuba ransomware affiliates claim that people behind the group’s leak site use Russian as their primary language.

Cuba ransomware was first noticed in early 2020. According to deep-web watchdog Darkfeed, Cuba ransomware has listed 75 victims on its leak site since its inception.

Meanwhile, the FBI says Cuba ransomware has hit over 101 entities, demanding $145 million and receiving $60 million in ransom payments.