CactusMalware
The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure. There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created.From MISP Galaxy
Last reported 6 months ago, by Zscaler ThreatLabz3 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“…anti-sandbox evasion technique.If the -nopersist parameter is not passed on the command-line, persistence is established using scheduled tasks by executing the following command:schtasks.exe /s "localhost" /ru "SYSTEM" /create /f /sc ONSTART /TN \Mozilla\UpdateTask /TR "<…”
- T1219Remote Access Tools
“…g, and fake tech support scams), strict enforcement of multi-factor authentication (MFA), and monitoring for the anomalous use of remote access tools like Quick Assist.”
- T1684Social Engineering
“This includes enhanced user training to recognize and report social engineering attacks (spam bombing, vishing, and fake tech support scams), strict enforcement of multi-factor authentication (MFA), and monitoring for the anomalous use of remote access tools like Quick Assist.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Payouts King Takes Aim at the Ransomware Throne“…he BlackBasta brand disappeared, the group’s former affiliates have continued attacks by deploying different ransomware families such as Cactus.”
-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“…ate infrastructure, the following groups were not seen as a part of currently analyzed clusters: LockBit, Cicada3301, Quantum, Nokoyawa, Cactus and Play.”
-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“With a low degree of confidence, we can attribute ShadowSyndicate to Royal, Cl0p, Cactus, and Play ransomware activity.”
Indicators in its reports
named in the reports above- anbush[.]comin 1 report
- mysqlserver[.]orgin 1 report
- ipulsecloud[.]comin 1 report
- esoftwareupdates[.]comin 1 report
- cmdatabase[.]comin 1 report
- maximumservers[.]netin 1 report
- avdev[.]netin 1 report
- devcloudpro[.]comin 1 report
- uranustechsolution[.]comin 1 report
- qw.sveexec[.]comin 1 report
- situotech[.]comin 1 report
- 1ca4cbac895fc3bd12417b77fc6ed31din 1 report
- 194.165.16[.]64in 1 report
- 46.161.27[.]151in 1 report
- 193.142.30[.]37in 1 report
- 193.142.30[.]205in 1 report
- 81.19.135[.]229in 1 report
- 194.165.16[.]53in 1 report
- 5.188.87[.]47in 1 report
- 194.165.16[.]90in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.