cactus

T1190Exploit Public-Facing Application

The group exploits vulnerabilities in VPN applications.

T1053.005Scheduled Task/Job: Scheduled Task

The group uses task scheduling for file execution for C2 communication and uses ransomware payload persistence.

T1072Software Deployment Tools

Actors attempt to gain access and use a set of third-party software installed on the network for lateral movement.

T1136Create Account

The group creates a service/system account to launch the ransomware.

T1027Obfuscated Files or Information

The group uses file obfuscation techniques to avoid detection by defenses.

T1027.002Obfuscated Files or Information: Software Packing

Actors use packing in ransomware payload to avoid detection by defenses.

T1562.001Disable or Modify Tools

The group uses modification and disabling of security tools to avoid possible malware and access detection.

T1003.001OS Credential Dumping

The group performs LSASS memory dump to identify credentials.

T1555.003Credentials from Web Browsers

The group searches for key files from users' browsers to locate stored passwords to proceed with the attack and access other accounts.

T1018Remote System Discovery

Actors attempt to obtain a list of other systems, hosts, IPs, and any other identifier for lateral movement.

T1049System Network Connections Discovery

Actors use tools to scan the organization's infrastructure systems.

T1087Account Discovery

Actors attempt to obtain a list of accounts, user names, and valid email addresses for later access.

T1087.002Account Discovery: Domain Account

Actors use scripts to identify domain accounts of connected users through Windows event logs.

T1021.001Remote Desktop Protocol

Cactus actors use valid accounts to log into devices via RDP.

T1021.004Remote Services: SSH

The group uses initial access to set up an SSH tunnel to C2.

T1570Lateral Tool Transfer

Actors use tools or other files between systems to prepare files and encrypt data.

T1567.002Exfiltration to Cloud Storage

Actors exfiltrate data to a cloud storage service through tools such as Rclone and others.

T1090Proxy

Actors use connection proxy to route network traffic between systems to avoid detection by security solutions.

T1219Remote Access Software

Actors use RDP connection to access other devices on the internal network.

T1486Data Encrypted for Impact

Actors use ransomware payload to encrypt data and change extensions.

T1538.008Malvertising

The threat actor was identified by Microsoft as responsible for the Danabot campaign via malvertising for final delivery of Ransomware Cactus.