cactus

· ActiveThe CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure.<br> <br> There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox.<br>Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

248

Status

Active

Sites

Countries Hit

Profile

https://www.bitdefender.com/blog/businessinsights/cactus-analyzing-a-coordinated-ransomware-attack-on-corporate-networks/

https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection

Top Countries

US130

GB20

CA20

FR11

IT9

DE7

NL6

ES6

AU5

DK4

Top Sectors

Manufacturing62

Business Services47

Technology38

Agriculture and Food Production15

Recent Victims

View all 248 →

optiline.com

EE · Construction

Mar 21, 2025

fplfood.com

US · Agriculture and Food Production

Mar 21, 2025

biagibros.com

US · Transportation/Logistics

Mar 21, 2025

assaabloy.com

SE · Manufacturing

Mar 17, 2025

kyb.com

JP · Technology

Mar 17, 2025

tempel.com

US · Technology

Mar 12, 2025

thermoid.com

US · Manufacturing

Mar 12, 2025