Ransomware.live: cactus

The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure.

There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

248

First Discovered

2023-07-20

victim

Last Discovered

2025-03-21

victim

Inactive Since

1yr

more than

Avg Delay

42.7

days

Infostealer

26.8%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics

Known Locations (3)

Title	Available	Last Visit	Server Info	FQDN
500: Internal Server Error	No	2026-04-28T07:22:54		`cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion`
	No	2026-04-28T07:25:28		`cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion`
Sonar - Encrypted communications	Yes	2026-05-14T00:45:26	nginx	`sonarmsng5vzwqezlvtu2iiwwdn3dxkhotftikhowpfjuzg7p3ca5eid.onion`

Target

Heatmap

Ransom Notes (6)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Nmap SoftPerfect NetScan placeholder	AnyDesk Splashtop SuperOps	placeholder placeholder placeholder	placeholder placeholder placeholder	Cobalt Strike placeholder placeholder	Chisel placeholder placeholder	placeholder placeholder placeholder	RClone placeholder placeholder

TTPs Matrix (11)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Defense Evasion	Credential Access	Discovery	Lateral Movement	Exfiltration	Command and Control	Impact	Resource Development
Exploit Public-Facing Application	Scheduled Task/Job: Scheduled Task	Create Account	Obfuscated Files or Information	OS Credential Dumping	Remote System Discovery	Remote Desktop Protocol	Exfiltration to Cloud Storage	Proxy	Data Encrypted for Impact	Malvertising
	Software Deployment Tools		Obfuscated Files or Information: Software Packing	Credentials from Web Browsers	System Network Connections Discovery	Remote Services: SSH		Remote Access Software
			Disable or Modify Tools		Account Discovery	Lateral Tool Transfer
					Account Discovery: Domain Account

YARA Rules (1)

Indicators of Compromise (IoCs) (54)

Email 3 Hash MD5 50 tox 1

Type	IOC
`Email`	`cactus787835@proton.me`
`Email`	`cactus@mexicomail.com`
`Email`	`halielang@protonmail.com`
`Hash MD5`	`0a75d6369662af48ce6789d6b313a9a5`
`Hash MD5`	`0c0ece5515f5e2719f0e0a93e1f112dc`
`Hash MD5`	`0e4ee38fe320cfb573a30820198ff442`
`Hash MD5`	`11af5c1051f89e0933646121eefb388b`
`Hash MD5`	`13ace884f11b68fd1d427f3f4effaf76`
`Hash MD5`	`13baaae3f238bff3b5d3294f66a63bc0`
`Hash MD5`	`155a1d61ba47a8fbb87ba1aced22649e`
`Hash MD5`	`1773e21117bd6a0e17a3975be84ab6ae`
`Hash MD5`	`1add9766eb649496bc2fa516902a5965`
`Hash MD5`	`1b99383c43c36fa94d046dca6423a93b`
`Hash MD5`	`214d097d63c0aa20ae2a833518c583a1`
`Hash MD5`	`273aa71a0ba88334060922563a8418cc`
`Hash MD5`	`28103f745f58a2af71d327012846c022`
`Hash MD5`	`28771790ad093c8efa027edbc680722a`
`Hash MD5`	`32d93a2ec1007aad3228ced140b31682`
`Hash MD5`	`36330349aa9c3dc0fee84e0c57283e65`
`Hash MD5`	`39fe99d2250954a0d5ed0e9ff9c41d81`
`Hash MD5`	`3dc738d44d0a5fe03568e09d59203a79`
`Hash MD5`	`3e748ba8609601283f21b4ecc784efed`
`Hash MD5`	`3f8dbb3a8b881cba220c124323e92e6b`
`Hash MD5`	`42bce02c8f6d561f02856a367272b835`
`Hash MD5`	`466a8e120c75770ecbc0c73f0439d304`
`Hash MD5`	`586a7991bb097e7c4ef676b180f65a6a`
`Hash MD5`	`5b4d60780f6b5bbb6cb0a28fee885422`
`Hash MD5`	`6bafa6190e30fcae5dda8017079f9980`
`Hash MD5`	`718d56fd19bbaf5e78c03e096dae64ca`
`Hash MD5`	`74e6deb66b7845af3eb2d61727bb0bad`
`Hash MD5`	`7fa55bf92073ca2115d70641566ce89b`
`Hash MD5`	`82cb0577a64e59d187ab3174d1095c22`
`Hash MD5`	`86281388d3cdbc77b337000b0725ea81`
`Hash MD5`	`949d9523269604db26065f002feef9ae`
`Hash MD5`	`977fe7712d2c2d8592c094a9de88170c`
`Hash MD5`	`9a3d11b64e78895b8997fc7ad471655e`
`Hash MD5`	`9f9f02ce0d1a1aa6e4e0b2867af09ba0`
`Hash MD5`	`a20f8391af142d78fa825e38f0f40965`
`Hash MD5`	`a73487356f1f47a6f87c470b150605e9`
`Hash MD5`	`b2951204c09e7791d83c58017742b297`
`Hash MD5`	`b7e14409b99a663fa181ec5e2abc8fb3`
`Hash MD5`	`c0193c3b51020b1504c401bb27b84bea`
`Hash MD5`	`c82121875584b5607f9d8a9c5c10889a`
`Hash MD5`	`ccb993b425257228bd48c0aac20d5027`
`Hash MD5`	`d811f4b4dc97b25751cd0e8373c533e3`
`Hash MD5`	`dd394a40255027c7354123fc0f1a6c05`
`Hash MD5`	`e28db6a65da2ebcf304873c9a5ed086d`
`Hash MD5`	`ea16d3eb7bafa159c311c7806729ccdd`
`Hash MD5`	`eba1596272ff695a1219b1380468293a`
`Hash MD5`	`ef6a62e5ef88cdcc946e8edafe7a2184`
`Hash MD5`	`efa0d819098dc38d7a92ecd7eaf8a82a`
`Hash MD5`	`f58f1d87d32d472d5e97c5bba5c0cb4b`
`Hash MD5`	`ffd340da6546fd9727011fa808af4ac1`
`tox`	`7367B422CD7498D5F2AAF33F58F67A332F8520CF0279A5FBB4611E0121AE421AE1D49ACEABB2`

Cactus