CACTUS

Cactus is a ransomware family/group active worldwide since at least March 2023, with reporting linking multiple attacks to the group from late 2023 onward. It is described as an emerging ransomware operation and has been referenced as one of the ransomware families used by former Black Basta affiliates after Black Basta’s collapse; separate reporting also notes similar social-engineering intrusion patterns involving email bombing, Microsoft Teams impersonation, and Quick Assist in Black Basta and Cactus intrusions. Cactus has targeted organizations through exploitation of internet-exposed, unpatched Qlik Sense servers. Joint analysis by Fox-IT, Northwave, Responders, and ESET Nederland found Dutch victims were consistently compromised via outdated Qlik Sense servers, and Project Melissa estimated roughly 5,200 internet-reachable Qlik Sense servers worldwide, more than 3,100 vulnerable, with 122 likely already exploited by Cactus. Arctic Wolf separately reported a campaign exploiting Qlik Sense vulnerabilities CVE-2023-41266 and CVE-2023-41265, and possibly CVE-2023-48365, to gain initial access and ultimately deploy Cactus ransomware.

Observed post-compromise behavior in Qlik Sense-related intrusions included Scheduler.exe spawning cmd.exe and PowerShell, use of PowerShell and BITS to download tooling, deployment of renamed ManageEngine UEMS components, AnyDesk, and PuTTY/Plink, execution of discovery commands with output redirected into .ttf files, uninstalling Sophos via msiexec, changing the local Administrator password, establishing an RDP tunnel with Plink over port 443, lateral movement via RDP, downloading WizTree, and exfiltration with rclone renamed to svchost.exe before ransomware deployment. Reported infrastructure and artifacts from that activity included zohoservice[.]net, 216.107.136[.]46, 144.172.122[.]30, 45.61.147[.]176, C:\Users\Public\svchost.exe, and a Plink sample with SHA-256 828e81aa16b2851561fff6d3127663ea2d1d68571f06cbd732fdf5672086924d.

The malware is associated with inhibiting recovery by deleting Windows shadow copies before encryption, and Splunk analytics explicitly tie Cactus to WMIC and PowerShell shadow-copy deletion behaviors mapped to ATT&CK T1490. Additional detection content associates Cactus with suspicious HTTP PUA user agents, suspicious DNS queries to Discord or other abused web services, and anomalous DLLHost, SearchProtocolHost, and Rundll32 executions without normal command-line arguments, though those analytics are detection associations rather than unique Cactus-exclusive traits. High-confidence targeting beyond the Qlik Sense intrusion set includes Dutch organizations identified through Project Melissa; broader ransomware reporting also places Cactus among active groups affecting multiple sectors globally.