Cactus
The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure.<br> <br> There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox.<br>Source: https://github.com/crocodyli/ThreatActors-TTPs
Threat level
HIGH
Get an alert if one of your domains is named on a ransomware leak site.
Tactics, Techniques & Procedures (TTPs)
DiscoveryEnum
- Nmap
- SoftPerfect NetScan
Exfiltration
- RClone
Networking
- Chisel
Offsec
- Cobalt Strike
RMM-Tools
- AnyDesk
- Splashtop
- SuperOps
Known infrastructure
The following Tor hidden services have been associated with this group:
cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion500: Internal Server Error
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Cactus’s victim list.
risk score · threat categories · sources · age · confidence — in one request