CACTUS

Cactus is a financially motivated ransomware group first observed in March 2023 and commonly tracked as a ransomware-as-a-service operation or affiliate-driven crew. It has been associated with double-extortion activity, combining data theft with ransomware deployment and public leak-site pressure. By April 2024, the group had reportedly attacked more than 100 organizations, and it remained among the more active ransomware brands through 2024 before later reporting indicated dormancy or decline during 2025. Cactus has used multiple initial-access pathways. A prominent and repeatedly documented tradecraft cluster involves exploitation of vulnerable internet-facing Qlik Sense servers beginning in November 2023, including abuse of CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365. It has also been observed leveraging legitimate remote monitoring and management tools such as AnyDesk, Splashtop, SuperOps, eHorus Agent, RMS Remote Admin, OpenSSH, and related remote-access software for initial access, persistence, reconnaissance, and remote operations. In some intrusions, access was handed to Cactus by an initial access broker tracked as ToyMaker, which exploited exposed systems, harvested credentials from memory, and then transferred the foothold. Operationally, Cactus conducts broad post-compromise activity including endpoint, server, and file-share enumeration; credential abuse; lateral movement; persistence establishment; data archiving and exfiltration; and preparation for ransomware deployment. Reported techniques include use of SMB and WinRM for lateral movement, scheduled tasks for recurring remote access, unauthorized account creation, Safe Mode reboot abuse to weaken defenses, and cleanup actions to remove traces of intrusion. The group has also been linked to use of remote administration tooling and exfiltration utilities during hands-on-keyboard operations. Cactus has additionally been associated with social-engineering-led intrusions resembling Black Basta affiliate tradecraft. These campaigns used email bombing, Microsoft Teams impersonation, and Quick Assist to obtain remote access, followed by DLL sideloading and deployment of BackConnect malware. Multiple reports assess overlap between Black Basta and Cactus operators or affiliates, including possible migration of personnel after Black Basta’s decline. Shared use of BackConnect malware, similar Teams and Quick Assist social engineering, and affiliate crossover have all been cited as evidence of this relationship. Blitz Brigantine has also been described as an affiliate operating for both Black Basta and Cactus. Known aliases include Cactus Group, Cactus ransomware group, Cactus ransomware gang, and Cactus ransomware actors.