Discovery Enum
- Nmap
- SoftPerfect NetScan
CACTUS
Cactus is a Windows ransomware family and ransomware-as-a-service operation first identified in March 2023.
Profile source: Mallory opens in a new tabCACTUS
Family profile
Cactus is a Windows ransomware family and ransomware-as-a-service operation first identified in March 2023. It encrypts victim data using per-file AES encryption protected by an embedded RSA public key, supports configurable encryption scope and threading, and can partially encrypt large files to accelerate impact. Encrypted files receive Cactus-specific extensions and the malware deploys a ransom note.
Cactus supports persistence through scheduled tasks, enumerates local and attached drives, avoids selected operating-system and application directories, and uses Restart Manager functionality to identify processes locking target files. Operators have also been observed deleting evidence, deploying remote-administration tools, creating unauthorized accounts, establishing reverse-shell access, performing endpoint and network reconnaissance, moving laterally, archiving data, and exfiltrating victim data before encryption. The operation is associated with double extortion.
Observed intrusions have exploited unpatched internet-exposed Qlik Sense Enterprise servers, including CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365. Other Cactus-linked campaigns used spam flooding, Microsoft Teams voice phishing, and social engineering to persuade targets to grant access through Microsoft Quick Assist. Cactus activity has affected critical infrastructure, manufacturing, construction, and Dutch organizations among other sectors. Reporting identifies operational and tradecraft overlap with Black Basta, including apparent migration of some former Black Basta affiliates to Cactus.
Capabilities
- Defense Evasion
- Exfiltration
- Extortion
- Initial Access
- Lateral Movement
- Persistence
- Reconnaissance
Operational record
51
Indicators
1
YARA rules
6
Ransom notes
2
Leak sites
0 available
Exfiltration
- RClone
Networking
- Chisel
Offsec
- Cobalt Strike
RMM Tools
- AnyDesk
- Splashtop
- SuperOps
Published indicators
Md5
50 total466a8e120c75770ecbc0c73f0439d304718d56fd19bbaf5e78c03e096dae64ca586a7991bb097e7c4ef676b180f65a6a7fa55bf92073ca2115d70641566ce89bccb993b425257228bd48c0aac20d502728103f745f58a2af71d327012846c02242bce02c8f6d561f02856a367272b83582cb0577a64e59d187ab3174d1095c2236330349aa9c3dc0fee84e0c57283e651773e21117bd6a0e17a3975be84ab6ae
Reported operators
Threat actors
4 named in public reportingIt has demonstrated the use of multiple top tier Ransomware-as-a-Service (RaaS) brands such as AlphaV/Blackcat, Lockbit, Play, Royal, Cl0p, Cactus and Ransomhub.
TrendMicro analyzed the BlackBasta and Cactus groups as being the work of the same attack group in that they used the same BackConnect malware in an attack strategy that used social engineering techniques to gain initial access and then exploited Microsoft Teams and Quick Assist.
Since November 2023, the Cactus ransomware group has been actively targeting vulnerable Qlik Sense servers.
Following BlackBasta’s shutdown, its former affiliates did not simply disappear. Instead, they regrouped and continued their criminal activities under different ransomware families, including Cactus, and more recently, Payouts King.
Exploited software
Vulnerabilities linked to CACTUS
7 CVEs CVE-2023-41266 Path Traversal Authentication Bypass in Qlik Sense Enterprise for Windows CVE-2023-41265 ZeroQlik HTTP Request Tunneling in Qlik Sense Enterprise for Windows CVE-2023-48365 DoubleQlik: Unauthenticated RCE in Qlik Sense Enterprise for Windows CVE-2023-27997 XORtigate CVE-2024-21762 Fortinet FortiOS and FortiProxy SSL-VPN Out-of-Bounds Write RCE CVE-2024-40766 Improper Access Control in SonicWall SonicOS Management Access and SSLVPN CVE-2025-23006 SonicWall SMA1000 AMC/CMC Pre-Authentication Deserialization RCE
MITRE ATT&CK
CACTUS in ATT&CK
27 distinct techniquesTechniques
27 techniques T1486 Data Encrypted for Impact T1021.001 Remote Desktop Protocol T1098 Account Manipulation T1219 Remote Access Tools T1021.004 SSH T1190 Exploit Public-Facing Application T1489 Service Stop T1598.004 Spearphishing Voice T1562.001 Disable or Modify Tools T1547.001 Registry Run Keys / Startup Folder T1133 External Remote Services T1490 Inhibit System Recovery T1053.005 Scheduled Task/Job: Scheduled Task T1072 Software Deployment Tools T1136 Create Account T1027 Obfuscated Files or Information T1027.002 Obfuscated Files or Information: Software Packing T1003.001 OS Credential Dumping T1555.003 Credentials from Web Browsers T1018 Remote System Discovery T1049 System Network Connections Discovery T1087 Account Discovery T1087.002 Account Discovery: Domain Account T1570 Lateral Tool Transfer T1567.002 Exfiltration to Cloud Storage T1090 Proxy T1538.008 Malvertising
Reporting
