Loading threat actor…
Cactus, also known as the Cactus ransomware group or Cactus ransomware gang, is a financially motivated cybercriminal operation active since March 2023. It targets commercial enterprises worldwide, particularly in the United States and Europe, with victims spanning manufacturing, healthcare, and food and agriculture. The group conducts double extortion by stealing data, encrypting systems, and threatening to publish stolen information on its dedicated leak site. Cactus gains access through vulnerable internet-facing applications and access obtained from initial access brokers. Documented campaigns exploited unpatched Qlik Sense servers using CVE-2023-41266 and CVE-2023-41265, or the mitigation-bypass vulnerability CVE-2023-48365. In a separately documented intrusion, the initial access broker ToyMaker compromised an enterprise before transferring access to Cactus; these actors are operationally distinct. Cactus intrusions can include weeks or months of inactivity between initial compromise and ransomware deployment. The group extensively abuses legitimate remote administration software for access and persistence, including AnyDesk, Splashtop, ManageEngine UEMS, Zoho Assist, DWAgent, and eHorus Agent. It also establishes recurring OpenSSH reverse connections through scheduled tasks and uses PuTTY-based tunnels to support RDP access and bypass network restrictions. Post-compromise activity includes host, account, domain, and file enumeration; unauthorized account creation; credential access; and lateral movement. Cactus uses WizTree to identify files for theft, archives data with 7-Zip, and exfiltrates information using Rclone, curl, and other transfer utilities. Defense-evasion measures include disguising payloads as software updates, removing command history and other intrusion artifacts, and rebooting hosts into Safe Mode to weaken security controls. Cactus has also used legitimate utilities modified with injected Metasploit shellcode. Before encryption, attackers delete Volume Shadow Copies to impede recovery. Documented attacks have encrypted systems across enterprise environments, including hypervisor operating systems.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
46 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
The vulnerability CVE-2023-41265 allowed the threat actor to elevate its privileges to a service account and execute these requests under the rights of this service account.
The vulnerability CVE-2023-41266 is a path traversal vulnerability which allowed the (unauthenticated) threat actor to create an anonymous session on a Qlik Sense application.
The bypass for the incomplete mitigation is recorded under CVE-2023-48365 and is dubbed DoubleQlik. Whether the combination of CVE-2023-41266 and CVE-2023-41265, or CVE-2023-48365 is abused cannot be determined by analysing Qlik Sense logs.
76 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as one of the groups that absorbed affiliates after the Black Basta collapse; later cited as an example of rebranded affiliate activity retaining the same tooling and behavior.
Ransomware team described as collaborating with Black Basta, including payments and operational coordination.
Named as one of the ransomware families used by former BlackBasta affiliates after BlackBasta’s shutdown.
初期侵入と偵察で複数のRMMツールを利用したランサムウェアアクターの例として挙げられている。
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.