Loading malware…
CACTUSTORCH is an offensive payload-delivery toolkit used to embed and launch shellcode from script-based containers including HTA, VBScript, JavaScript, and VBA. It is designed to spawn a 32-bit process such as rundll32.exe or notepad.exe and inject shellcode into that process, making it a common wrapper for Cobalt Strike Beacon and other in-memory payloads. The toolkit has been used in intrusion activity to deliver .NET payloads and Cobalt Strike beacons through script content and malicious Office or Access documents, including VBA droppers derived from its modules.
Observed tradecraft shows CACTUSTORCH being used as a staged execution mechanism rather than as a full-featured implant. In HTA-based chains, it has been associated with fileless execution, .NET deserialization, and process injection to launch follow-on malware while reducing on-disk artifacts. It has also appeared in campaigns using malicious attachments and script launchers, including espionage operations targeting defense and government-related entities and activity attributed to groups such as GADOLINIUM and operations assessed as linked to Transparent Tribe. Because it is an open-source adversary-simulation tool, its presence alone does not uniquely identify an actor, but it is regularly repurposed in real-world attacks for defense evasion and post-exploitation payload execution on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The file mm.accdb.core is a VBA dropper, based on the CactusTorch VBA module, which loads a .NET DLL payload, sets configuration information, and then runs the payload.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Process names like this in malicious code typically mean that the malicious binary content will be saved and executed as the process name or injected into a process of the same name... For this particular threat, we’ll likely see a process ancestry of mshta.exe -> notepad.exe -> rundll32.exe.
Process names like this in malicious code typically mean that the malicious binary content will be saved and executed as the process name or injected into a process of the same name... For this particular threat, we’ll likely see a process ancestry of mshta.exe -> notepad.exe -> rundll32.exe.
There are two large chunks of base64 code in the file... The first base64 chunk starts with TVro, which decodes to a MZ header seen with Windows EXEs.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A script-based loader/stager framework used to embed and execute Cobalt Strike beacons from HTA or VBS content.
An open-source VBA-based loader/dropper module used as the basis for a malicious Access-delivered dropper that loads and executes a .NET payload.
Utility/loader used to execute shellcode (noted in context of Cobalt Strike modules).
An offensive toolkit used to generate fileless HTA stagers that load .NET assemblies in memory; mentioned as tooling used in the infection chain rather than the primary malware family under analysis.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.