Ministry of Energy and Mines (Cuba) targeted by Stormous and GhostSec

• Ransomware group: Stormous
• Country: Cuba
• Sector: Energy & Utilities
• Announcement date: July 12, 2023

Stormous and GhostSec claim data breach at Cuban ministry

The ransomware groups Stormous and GhostSec have listed the Ministry of Energy and Mines of Cuba on their respective leak sites. According to the claims made by these threat actors, they have successfully gained unauthorized access to the institution's internal systems. The announcement, which appeared on July 12, 2023, suggests that the data exfiltration and subsequent leak process has already been concluded, with the information being released to the public.

This type of activity is characteristic of modern ransomware operations, often involving double extortion tactics. In such scenarios, threat actors do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish stolen data on public leak sites, attackers aim to pressure the victim into meeting ransom demands, leveraging the potential for reputational damage and regulatory scrutiny.

Details regarding the alleged leak

While the threat actors have officially listed the Ministry of Energy and Mines on their leak site, the specific details regarding the nature of the stolen information remain unclear. At this time, no specific details or sample files regarding the nature of the alleged leaked data have been provided by the groups involved. Furthermore, the groups have not disclosed the total size of the data stolen or the specific file count involved in the breach. There is also no information available regarding a ransom demand or the specific timing of the initial intrusion, other than the date the leak was announced.

Summary of information status

• No specific data types or file samples have been provided.
• No information regarding the volume of data or file count is available.
• No ransom demand has been disclosed.

The target organization

The target of this alleged attack is the Ministry of Energy and Mines of Cuba. This government body is responsible for the management and oversight of the country's vital energy and resource sectors, specifically focusing on oil, electricity, and mining. The ministry was established in 2012 following a structural transformation of the former Ministry of Basic Industry, making it a central pillar of the nation's economic and industrial infrastructure.

Potential implications and industry considerations

This incident may pose a significant risk to operational continuity, given that it targets a public institution operating within the critical infrastructure sector. When a government entity responsible for essential services like electricity and energy is targeted, the implications can extend beyond simple data loss. The exposure of sensitive information within such a ministry could have negative implications for state security and the integrity of supply chain processes.

The actions of groups that claim political motivation can cause lasting damage to an institution's reputation and could potentially pave the way for secondary attacks that might disrupt public services. Considering the past methods of the Stormous group, it is possible that such leaks could serve as a starting point for targeted phishing campaigns or broader network intrusions. For example, stolen credentials or internal communications can be used to craft highly convincing social engineering attacks against employees.

For organizations operating within critical infrastructure sectors, maintaining robust defensive postures is essential. This includes implementing strict access controls, continuous monitoring of network traffic for anomalous behavior, and ensuring that all systems are patched against known vulnerabilities. Additionally, organizations should focus on comprehensive data encryption and regular offline backups to mitigate the impact of both encryption-based and exfiltration-based attacks. Developing a clear incident response plan that accounts for both operational recovery and data breach communication is also a vital component of modern cybersecurity resilience.