CACTUS Ransomware Group

Actor Type Criminal Group

CACTUS is ransomware group observed targeting victims since at least March 2023. The name CACTUS has been derived from the ransom note left with an intrusion: 'cAcTuS.readme.txt'.

Researchers from Kroll note that CACTUS commonly uses tools including Chisel, Rclone, TotalExec, Scheduled Tasks and that they have been observed gaining initial access through exploitation of VPN appliances.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

CACTUS Ransomware Group Threat Reports

Report

CACTUS Ransomware: Prickly New Variant Evades Detection

This report by Kroll outlines TTPs and IoCs associated with CACTUS ransomware actors.

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.