Cactus

The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure.

There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

248

First Discovered

2023-07-20

victim

Last Discovered

2025-03-21

victim

Inactive Since

364

days

Avg Delay

37.5

days

Infostealer

8.9%

victims with domain

View Victims on World Map

View group statistics

Known Locations (3)

Title	Available	Last Visit	Server Info	FQDN
500: Internal Server Error	No	2025-06-01 21:18:20		`cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion`
	No	2025-06-01 21:19:20		`cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion`
Sonar - Encrypted communications	Yes	2026-03-20 19:31:09	nginx	`sonarmsng5vzwqezlvtu2iiwwdn3dxkhotftikhowpfjuzg7p3ca5eid.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (6)

Tools Used (Available)

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Nmap SoftPerfect NetScan placeholder	AnyDesk Splashtop SuperOps	placeholder placeholder placeholder	placeholder placeholder placeholder	Cobalt Strike placeholder placeholder	Chisel placeholder placeholder	placeholder placeholder placeholder	RClone placeholder placeholder

Vulnerabilities Exploited (0)

TTPs Matrix (11)

This information is provided by Crocodyli & Ransomware.live
Resource Development	Initial Access	Execution	Discovery	Command and Control	Defense Evasion	Persistence	Credential Access	Lateral Movement	Exfiltration	Impact
Malvertising	Exploit Public-Facing Application	Scheduled Task/Job: Scheduled Task	System Network Connections Discovery	Remote Access Software	Disable or Modify Tools	Create Account	Credentials from Web Browsers	Remote Services: SSH	Exfiltration to Cloud Storage	Data Encrypted for Impact
		Software Deployment Tools	Account Discovery: Domain Account	Proxy	Obfuscated Files or Information		OS Credential Dumping	Remote Desktop Protocol
			Remote System Discovery		Obfuscated Files or Information: Software Packing			Lateral Tool Transfer
			Account Discovery

Negotiation Chats (0)

YARA Rules (1)

Indicators of Compromise (IoCs) (51)

MD5 51

Type	IOC
`md5`	`466a8e120c75770ecbc0c73f0439d304`
`md5`	`718d56fd19bbaf5e78c03e096dae64ca`
`md5`	`586a7991bb097e7c4ef676b180f65a6a`
`md5`	`7fa55bf92073ca2115d70641566ce89b`
`md5`	`ccb993b425257228bd48c0aac20d5027`
`md5`	`28103f745f58a2af71d327012846c022`
`md5`	`42bce02c8f6d561f02856a367272b835`
`md5`	`82cb0577a64e59d187ab3174d1095c22`
`md5`	`36330349aa9c3dc0fee84e0c57283e65`
`md5`	`1773e21117bd6a0e17a3975be84ab6ae`
`md5`	`e28db6a65da2ebcf304873c9a5ed086d`
`md5`	`dd394a40255027c7354123fc0f1a6c05`
`md5`	`c82121875584b5607f9d8a9c5c10889a`
`md5`	`1add9766eb649496bc2fa516902a5965`
`md5`	`28771790ad093c8efa027edbc680722a`
`md5`	`6bafa6190e30fcae5dda8017079f9980`
`md5`	`39fe99d2250954a0d5ed0e9ff9c41d81`
`md5`	`c0193c3b51020b1504c401bb27b84bea`
`md5`	`d811f4b4dc97b25751cd0e8373c533e3`
`md5`	`f58f1d87d32d472d5e97c5bba5c0cb4b`
`md5`	`155a1d61ba47a8fbb87ba1aced22649e`
`md5`	`b2951204c09e7791d83c58017742b297`
`md5`	`3f8dbb3a8b881cba220c124323e92e6b`
`md5`	`a20f8391af142d78fa825e38f0f40965`
`md5`	`ffd340da6546fd9727011fa808af4ac1`
`md5`	`11af5c1051f89e0933646121eefb388b`
`md5`	`3dc738d44d0a5fe03568e09d59203a79`
`md5`	`eba1596272ff695a1219b1380468293a`
`md5`	`977fe7712d2c2d8592c094a9de88170c`
`md5`	`32d93a2ec1007aad3228ced140b31682`
`md5`	`0a75d6369662af48ce6789d6b313a9a5`
`md5`	`1b99383c43c36fa94d046dca6423a93b`
`md5`	`9f9f02ce0d1a1aa6e4e0b2867af09ba0`
`md5`	`13ace884f11b68fd1d427f3f4effaf76`
`md5`	`273aa71a0ba88334060922563a8418cc`
`md5`	`3e748ba8609601283f21b4ecc784efed`
`md5`	`0c0ece5515f5e2719f0e0a93e1f112dc`
`md5`	`42bce02c8f6d561f02856a367272b835`
`md5`	`5b4d60780f6b5bbb6cb0a28fee885422`
`md5`	`214d097d63c0aa20ae2a833518c583a1`
`md5`	`b7e14409b99a663fa181ec5e2abc8fb3`
`md5`	`ea16d3eb7bafa159c311c7806729ccdd`
`md5`	`9a3d11b64e78895b8997fc7ad471655e`
`md5`	`efa0d819098dc38d7a92ecd7eaf8a82a`
`md5`	`ef6a62e5ef88cdcc946e8edafe7a2184`
`md5`	`0e4ee38fe320cfb573a30820198ff442`
`md5`	`74e6deb66b7845af3eb2d61727bb0bad`
`md5`	`13baaae3f238bff3b5d3294f66a63bc0`
`md5`	`949d9523269604db26065f002feef9ae`
`md5`	`a73487356f1f47a6f87c470b150605e9`
`md5`	`86281388d3cdbc77b337000b0725ea81`