Connecting the Bots

**Hancitor-to-Cuba ransomware campaign:** Group-IB documents active Hancitor campaigns that drop additional payloads (Cuba ransomware, Ficker stealer, Cobalt Strike, SystemBC) via DocuSign-themed spam and malicious Word macros, details C2 protocol and commands, post-exploitation TTPs (mimikatz, PsExec, RDP, SMB beacons), and notes exfiltration published on a Cuba data-leak site.