CACTUS

Cactus is a financially motivated ransomware and extortion group active since 2023. The group has conducted global intrusions, including attacks against Dutch organizations, and has targeted internet-exposed, unpatched Qlik Sense servers for initial access since at least November 2023. It has also affected organizations in the healthcare and food-and-agriculture sectors. Cactus operations have involved exploitation of public-facing applications, reconnaissance and enumeration, credential-based access, deployment of legitimate remote-management tools, creation of unauthorized accounts, scheduled-task persistence, lateral movement through SMB and WinRM, data staging and exfiltration, and removal of forensic artifacts. In a documented intrusion following an access handoff from the ToyMaker initial-access group, Cactus performed network and endpoint enumeration, archived and exfiltrated customer data, deployed remote-administration software and OpenSSH reverse-shell persistence, and prepared systems for ransomware deployment. The group has also used Safe Mode rebooting to impair security controls. Cactus has used social-engineering tradecraft involving email flooding, Microsoft Teams impersonation, and abuse of Microsoft Quick Assist. Related activity used DLL sideloading to deploy BackConnect malware, followed by lateral movement and compromise of ESXi infrastructure. Cactus is a double-extortion operation: it steals data and uses the threat of publication alongside ransomware deployment. It has operated a dedicated leak site and has identified itself in ransom communications as the Cactus Group. The group is also referred to as Cactus Group, Cactus ransomware group, and Cactus ransomware gang.