HackerFeeds
All ransomware groups

cactus

248 tracked victims
·first seen 2023-07-03·last activity 2025-03-17

Activity analysis

HackerFeeds has tracked 248 victims claimed by cactus since July 2023, most recently in March 2025 — ranking #28 of 332 groups (0.7% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in March 2025. Its most-targeted sector is Manufacturing (51 victims), followed by Business Services (44). The United States accounts for 105 victims (53% of those with a known location); 50 victims did not disclose a location.

Victims per year

  • 2023104
  • 202496
  • 202548

Top sectors

  • Manufacturing51
  • Business Services44
  • Technology39
  • Consumer Services29
  • Construction20
  • Agriculture and Food Production16

Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology

Group profile

The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure.<br> <br> There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox.<br>Source: https://github.com/crocodyli/ThreatActors-TTPs

MITRE ATT&CK TTPs

TA0001

Initial Access

  • T1190Exploit Public-Facing Application

    The group exploits vulnerabilities in VPN applications.

TA0002

Execution

  • T1053.005Scheduled Task/Job: Scheduled Task

    The group uses task scheduling for file execution for C2 communication and uses ransomware payload persistence.

  • T1072Software Deployment Tools

    Actors attempt to gain access and use a set of third-party software installed on the network for lateral movement.

TA0003

Persistence

  • T1136Create Account

    The group creates a service/system account to launch the ransomware.

TA0005

Defense Evasion

  • T1027Obfuscated Files or Information

    The group uses file obfuscation techniques to avoid detection by defenses.

  • T1027.002Obfuscated Files or Information: Software Packing

    Actors use packing in ransomware payload to avoid detection by defenses.

  • T1562.001Disable or Modify Tools

    The group uses modification and disabling of security tools to avoid possible malware and access detection.

TA0006

Credential Access

  • T1003.001OS Credential Dumping

    The group performs LSASS memory dump to identify credentials.

  • T1555.003Credentials from Web Browsers

    The group searches for key files from users' browsers to locate stored passwords to proceed with the attack and access other accounts.

TA0007

Discovery

  • T1018Remote System Discovery

    Actors attempt to obtain a list of other systems, hosts, IPs, and any other identifier for lateral movement.

  • T1049System Network Connections Discovery

    Actors use tools to scan the organization's infrastructure systems.

  • T1087Account Discovery

    Actors attempt to obtain a list of accounts, user names, and valid email addresses for later access.

  • T1087.002Account Discovery: Domain Account

    Actors use scripts to identify domain accounts of connected users through Windows event logs.

TA0008

Lateral Movement

  • T1021.001Remote Desktop Protocol

    Cactus actors use valid accounts to log into devices via RDP.

  • T1021.004Remote Services: SSH

    The group uses initial access to set up an SSH tunnel to C2.

  • T1570Lateral Tool Transfer

    Actors use tools or other files between systems to prepare files and encrypt data.

TA0010

Exfiltration

  • T1567.002Exfiltration to Cloud Storage

    Actors exfiltrate data to a cloud storage service through tools such as Rclone and others.

TA0011

Command and Control

  • T1090Proxy

    Actors use connection proxy to route network traffic between systems to avoid detection by security solutions.

  • T1219Remote Access Software

    Actors use RDP connection to access other devices on the internal network.

TA0040

Impact

  • T1486Data Encrypted for Impact

    Actors use ransomware payload to encrypt data and change extensions.

TA0042

Resource Development

  • T1538.008Malvertising

    The threat actor was identified by Microsoft as responsible for the Danabot campaign via malvertising for final delivery of Ransomware Cactus.

Recent victims

No victims tracked yet.