CACTUS

Cactus is a ransomware family and ransomware operation active worldwide since at least March 2023, with reporting also describing it as linked to multiple attacks worldwide since late 2023. It is used in double-extortion campaigns in which operators steal data and encrypt victim systems, and victims are pressured through leak-site publication. Reported behavior includes deleting shadow copies before encryption to inhibit recovery and using the Windows Restart Manager library (RstrtMgr.dll) to kill processes that would otherwise lock files and interfere with encryption.

High-confidence reporting links Cactus to financially motivated ransomware activity and to shared or migrating affiliates from other major ransomware ecosystems. Multiple sources note overlap with Black Basta, including use of BackConnect malware previously seen in Black Basta attacks, similar TTPs such as email flooding followed by Microsoft Teams or Quick Assist social engineering, and assessments that some former Black Basta members or affiliates moved to Cactus. Cisco Talos also reported a 2023 intrusion in which an initial access broker it tracks as ToyMaker exploited vulnerable internet-facing systems, deployed the LAGTOY backdoor, harvested credentials from memory, and later handed access to Cactus.

Observed Cactus intrusion activity includes use of stolen credentials; endpoint, server, and file enumeration; archiving data with 7z; exfiltration with curl and other transfer tools; deletion of command history and Terminal Server Client artifacts; deployment of remote administration tools including eHorus Agent, AnyDesk, RMS Remote Admin, and OpenSSH; creation of scheduled tasks for recurring OpenSSH reverse shells over port 443; creation of unauthorized accounts such as "whiteninja"; modification of Winlogon registry keys; and use of bcdedit and shutdown commands to reboot hosts into Safe Mode, likely to weaken or evade security products. Talos also observed Metasploit shellcode-injected copies of PuTTY and ApacheBench, plus ELF binaries, communicating with 51.81.42.234 over ports 53, 443, 8343, and 9232.

Cactus has been associated with campaigns targeting manufacturing and construction organizations, and Talos reported a major pre-ransomware/ransomware campaign using Black Basta and later Cactus tradecraft in which actors spammed victims’ inboxes, contacted them via Microsoft Teams, convinced them to launch Quick Assist sessions, established persistence, and then conducted privilege escalation and lateral movement. Talos identified a previously undocumented Cactus ransomware variant with new command-line arguments that gave operators greater control over the binary. Cactus has also been tied to attacks against organizations with exposed or outdated Qlik Sense servers. Joint research under Project Melissa found that identified Dutch victims were compromised through internet-exposed Qlik Sense servers not running the latest version; the project estimated about 5,200 Qlik Sense servers were internet reachable worldwide, more than 3,100 were vulnerable, and 122 had likely already been exploited by Cactus.

Known indicators and notable artifacts directly mentioned in the content include the attacker-created local administrator account "support" with password "Sup0rtadmin" during the ToyMaker phase preceding Cactus access; unauthorized account "whiteninja"; the LAGTOY/HOLERUN backdoor persisted as service "WmiPrvSV"; modification of permissions on C:\Windows\Temp\syslog.txt to protect an SSH private key; and network communications to 51.81.42.234 on ports 53, 443, 8343, and 9232. Reporting also notes Dutch victimization, worldwide distribution, and later ecosystem reporting that listed Cactus among groups that became dormant or ceased operations in 2025.