Ransomware Group intelligence
Cactus
InactiveTrack Cactus with 248 published victims and 3 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Cactus is tracked by Breach House as a ransomware group with 248 published victims.
United States is currently the most targeted country in this dataset.
3 known leak locations are currently associated with this group.
Leak Status Distribution
No leak-status data available yet.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (3)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Onion service | Up checked 3h ago | sonarmsng5vzwqezlvtu2iiwwdn3dxkhotftikhowpfjuzg7p3ca5eid.onion |
| Leak location 1 | Onion service | Down checked 3h ago | cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion |
| Leak location 2 | Onion service | Down checked 3h ago | cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion |
Top Activity Sectors (16)
- Communication / Marketing 144
- Manufacturing / Engineering 16
- Construction / Real Estate 16
- Services 14
- Finance / Legal / Insurance 13
- Healthcare / Pharma 8
- Hospitality / Food & Beverage / Tourism 7
- Transportation / Travel / Logistics 6
- IT 6
- Agriculture / Food 4
- Not identified 4
- Retail / E-commerce 3
- Energy 3
- Public Sector 2
- Education 1
- NGOs / Associations 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Cactus, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: cactus executes PowerShell scripts to stage ransomware payloads and manipulate system processes.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: cactus disables antivirus and monitoring tools by terminating security processes and modifying system configurations.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: cactus deletes Volume Shadow Copies and backup files via PowerShell commands to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: cactus discovers remote hosts using native network APIs to map the victim infrastructure before deploying ransomware.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1049 System Network Connections Discovery Discovery
What they do: cactus enumerates active network connections to identify critical services and isolate compromised hosts.
What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
-
T1135 Network Share Discovery Discovery
What they do: cactus scans network shares to identify victim file servers and high-value data repositories for targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: cactus moves laterally through SMB shares to access additional systems within the victim network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: cactus exfiltrates stolen data via encrypted C2 channels before deploying the ransomware payload.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: cactus encrypts victim files using strong symmetric encryption, appending a distinctive ransom note to each affected directory.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1491.001 Internal Defacement Impact
What they do: cactus performs internal defacement by replacing victim documents and web content with ransom notices.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
Tools Observed (8)
▼Software Cactus has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Discovery & enumeration
Nmap
SoftPerfect NetScan
Exfiltration
RClone
Networking & tunnelling
Chisel
Offensive security tooling
Cobalt Strike
Remote monitoring & management
AnyDesk
Splashtop
SuperOps
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Ransom Notes (6)
▼The note this group leaves on a compromised machine. Click a filename to read it.
cAcTuS.readme_6.txt
Your corporate network was compromised and encrypted by Cactus. Do not interrupt the encryption process, don't stop or reboot your machines until the encryption is complete. Otherwise the data may be corrupted. In addition to the encrypted infrastructure, we have downloaded a lot of confidential information from your systems. The publication of these documents may cause the termination of your commercial activities, contracts with your clients and partners, and multiple lawsuits. If you ignore this warning and do not contact us, your sensitive data will be posted on our blog: https://cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion/ In your best interest is to avoid contacting law enforcement and data recovery companies. They can't help you with the recovery, will cause more problems and expenses, and delay the return to normal work significantly. Besides, if you contact the police we will immediately publish your data. A quick recovery is very important to keep your business running at full capacity and minimize losses. This is why you need to begin negotiations as soon as possible. By the way, if you don't contact us within 5 days, we will start publishing your data. Download TOR Browser (https://www.torproject.org/download) and follow the link: http://webmail.74racbmxqyyd5jbtmdk7zd2qvpmfcvdigao64bm6iyxfujgqpyirhpid.onion Your username: [snip] Your password: [snip] Reply to the welcome email and we will get your message. Backup contact is TOX (https://tox.chat): 7367B422CD7498D5F2AAF33F58F67A332F8520CF0279A5FBB4611E0121AE421AE1D49ACEABB2
cAcTuS.readme_5.txt
Your systems were accessed and encrypted by Cactus. Do not interrupt the encryption process, don't stop or reboot your machines. Otherwise the data may be corrupted and unrecoverable. The best you can do is wait until encryption is finished to keep your files safe . Besides, we have downloaded a huge pack of confidential information from your sy stems. Your data will be sold or published in our blog https:\cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion in case of non-payment To recover your files and prevent disclosure of your sensitive data contact us via email: [email protected] Your unique ID: [snip] Backup contacts: http://sonarmsng5vzwqezlvtu2iiwwdn3dxkhotftikhowpfjuzg7p3ca5eid.onion/contact/Cactus_Support TOX (https://tox.chat/): 7367B422CD7498D5F2AAF33F58F67A332F8520CF0279A5FBB4611E0121AE421AE1D49ACEABB2
cAcTuS.readme_4.txt
Your systems were accessed and encrypted by Cactus. Do not interrupt the encryption process, don't stop or reboot your machines. Otherwise the data may be corrupted and unrecoverable. The best you can do is wait until encryption is finished to keep your files safe. Besides, we have downloaded a huge pack of confidential information from your systems. To recover your files and prevent disclosure of your sensitive data contact us via email: [email protected] Your unique ID: Backup contacts: http://sonarmsng5vzwqezlvtu2iiwwdn3dxkhotftikhowpfjuzg7p3ca5eid.onion/contact/Cactus_Support TOX (https://tox.chat/): 7367B422CD7498D5F2AAF33F58F67A332F8520CF0279A5FBB4611E0121AE421AE1D49ACEABB2
cAcTuS.readme.txt
Your systems were accessed and encrypted by Cactus. Do not interrupt the encryption process, don't stop or reboot your machines. Otherwise the data may be corrupted and unrecoverable. The best you can do is wait until encryption is finished to keep your files safe. Besides, we have downloaded a huge pack of confidential information from your systems. To recover your files and prevent disclosure of your sensitive data contact us via email: [email protected] Your unique ID: Backup contacts: EMAIL: [email protected] TOX (https://tox.chat/): 7367B422CD7498D5F2AAF33F58F67A332F8520CF0279A5FBB4611E0121AE421AE1D49ACEABB2
cAcTuS.readme_2.txt
Your systems were accessed and encrypted by Cactus. Do not interrupt the encryption process, don't stop or reboot your machines. Otherwise the data may be corrupted and unrecoverable. The best you can do is wait until encryption is finished to keep your files safe. Besides, we have downloaded a huge pack of confidential information from your systems. To recover your files and prevent disclosure of your sensitive data contact us via email: [email protected] Your unique ID: Backup contacts: EMAIL: [email protected] TOX (https://tox.chat/): 7367B422CD7498D5F2AAF33F58F67A332F8520CF0279A5FBB4611E0121AE421AE1D49ACEABB2
cAcTuS.readme_3.txt
Your systems were accessed and encrypted by Cactus. To recover your files and prevent data disclosure contact us via email: [email protected] Your unique ID reference: Backup contact: TOX (https://tox.chat/): 7367B422CD7498D5F2AAF33F58F67A332F8520CF0279A5FBB4611E0121AE421AE1D49ACEABB2
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (248)
Search, filter and paginate the victim timeline for Cactus. Showing 201–248 of 248.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Astro Lighting id8860 View details | Communication / Marketing | — | |||
|
Astro specialises predominantly in wall and ceiling lighting, and has achieved a wide reputation as the leading supplier of bathroom lighting in the UK. |
||||||
| Ransomware | DM Civil id8716 View details | Australia | Construction / Real Estate | — | — | |
|
DM Civil provides tailored, sustainable civil contracting solutions to many of Australia’s leading companies. A privately owned company established in 1976 by Reg Toohey, Tony Spanjers and his late brother Eric Spanjers. Since then, we have grown to be one of Western Australia’s most trusted and respected civil contractors. We offer a diverse range of civil construction capabilities: • Water Infrastructure • Pipelines • Land Development • Trenchless technology • Mining Infrastructure • Trencher Hire & Services We consistently align ourselves with industry best practice and guarantee the delivery of client focussed construction solutions. |
||||||
| Ransomware | Bacon Universal id8699 View details | Construction / Real Estate | — | |||
|
Bacon Universal Company, Inc. has proudly served Hawaii's Construction Industry for more than 60 years. |
||||||
| Ransomware | Spuncast id8698 View details | Communication / Marketing | — | |||
|
Spuncast, Inc was founded in 1976 and is headquartered in Watertown, Wisconsin. The company provides centrifugal castings and offers stainless steel tubing products, such as hydraulic cylinders. |
||||||
| Ransomware | Peacock Bros id8689 View details | Australia | Services | — | ||
|
Peacock Bros. Pty Ltd, Australian-owned and operated since 1888, has grown into one of the ANZ region’s largest providers of Data Management and Printing Solutions with branches in Melbourne, Sydney, Brisbane, Perth, Adelaide and Auckland. Manufacturers of high quality barcode and colour labels, we also work with the best technology brands to provide exceptional products, solutions and support for all your supply chain needs: - Barcode labels, Tags and Colour Labels - Thermal Printing, Ribbons & Applicator Systems - ID Card Services - Scanning & Mobile Computing - Wireless Infrastructure & Networking Solutions - Customized Software Solutions - Project Management & Engineering - Authorized Service & Support. |
||||||
| Ransomware | Wardlaw Claims Service id8581 View details | Finance / Legal / Insurance | — | |||
|
Wardlaw Claims Service is an industry-leading claims management and risk solutions firm founded in 1965. Today, we remain one of the largest privately held IA firms in the industry. No large conglomerates here! Our clients experience personalized services tailored to the nature of their risk management needs. Our services range from Daily & Catastrophe Field Adjusting in Residential and Commercial Property to Desk Adjusting, Auto Appraisal, Casualty & Liability, Emergency Services Invoice Reviews and more. We use industry leading claims technology to best serve our clients and their policyholders with INTEGRITY, ACCURACY & EXCELLENCE. |
||||||
| Ransomware | Levine Bagade Han id8576 View details | Communication / Marketing | — | — | ||
|
Levine Bagade Han LLP is an intellectual property law practice in Palo Alto, CA. We work closely with fast-moving clients who care about their intellectual property. Though we have experience in other areas, we focus on IP. Strategy, invention disclosure management, patent prosecution, portfolio management, due diligence (client and investor based), licensing, litigation strategy… We help you with IP strategy that matches your company's business objectives. We use our experience to guide clients through IP mazes and minefields. At our core, we strive to create a client-centered practice that is unique to the intellectual property legal field. |
||||||
| Ransomware | Leekes id8575 View details | United Kingdom | Retail / E-commerce | — | — | |
|
Retailer of homeware and home furnishing products. The company is a family owned chain of home department stores selling furniture and accessories plus conservatories, orangeries, windows, doors, kitchen and bathroom products through online and offline stores in South Wales, United Kingdom. |
||||||
| Ransomware | My Insurance Broker id8574 View details | Finance / Legal / Insurance | — | |||
|
Founded in 2008, My Insurance Broker is a Canadian community-dedicated brokerage. |
||||||
| Ransomware | Unimarketing id8573 View details | Canada | Communication / Marketing | — | ||
|
Unimarketing is a company that operates in the Information Technology and Services industry. It employs 21-50 people and has $10M-$25M of revenue. The company is headquartered in Chicoutimi, Quebec, Canada. |
||||||
| Ransomware | Geo Tek id8549 View details | Communication / Marketing | — | — | ||
|
Incorporated in 1997, GeoTek is a full service consulting engineering firm specializing in geotechnical engineering, construction materials testing, special inspections, and environmental consulting. GeoTek is founded on the principal of providing strong business partnerships with clients by demonstrating a committed passion for those who demand technical advice and responsive customer service that adds value to the client's project. |
||||||
| Ransomware | Custom Powder Systems id8547 View details | United States | Services | — | — | |
|
Custom Powder Systems is actually a containment company, so as a containment company, we offer many different solutions for customers. |
||||||
| Ransomware | JSS Almonds id8546 View details | Communication / Marketing | — | — | ||
|
JSS Almonds is a grower and processor of whole and natural California Almonds. Our facility specializes in shelled and inshell almonds. JSS Almonds serves over 15000 acres and specializes in natural, whole, and brown skin almond processing. |
||||||
| Ransomware | atWork Office Furniture id8545 View details | Canada | Services | — | — | |
|
atWork offers wide selection of office furniture, design services, installation. |
||||||
| Ransomware | BRiC Partnership id8544 View details | India | Communication / Marketing | — | — | |
|
BRiC is a consulting engineering firm with offices located in Belleville, Illinois; Evansville, Indiana; Springfield, Illinois; and Kirkwood, Missouri. While the four principals have been providing engineering services since the 1980's, BRiC Partnership was formed in 2002. |
||||||
| Ransomware | TORMAX USA id8531 View details | United States | Communication / Marketing | — | ||
|
TORMAX USA Inc. is committed to providing exceptional services with highly qualified technical advisers and service technicians on automatic door systems since 1997. |
||||||
| Ransomware | West Craft Manufacturing id8530 View details | Manufacturing / Engineering | — | |||
|
West Craft Manufacturing Inc. is an industry leader in the production of custom hydraulic cylinders and pneumatic cylinders for a diverse range of industries. We are specialized in designing and manufacturing custom hydraulic cylinders as per your specifications. |
||||||
| Ransomware | Trimaran Capital Partners id8529 View details | Finance / Legal / Insurance | — | |||
|
Led by Managing Partners Jay R. Bloom and Dean C. Kehler and Managing Director Michael G. Maselli, Trimaran Capital Partners ("Trimaran") is a private New York-based investment firm based in New York founded in 1998. |
||||||
| Ransomware | Specialised Management Services id8528 View details | Services | — | — | ||
|
Specialised Management Services Ltd (SMS) was formed in 1999 predominately as a service and support company to the oil and gas industry. |
||||||
| Ransomware | Maxxd Trailers id8502 View details | Canada | Retail / E-commerce | — | ||
|
MAXXD is a subsidiary of Maxey Trailers Mfg. Inc., a Texas company in business since 1999. The company began as a one man shop and has grown to an operation of 70 employees who produce 5,000 trailers annually for clients across the U.S. and Canada. |
||||||
| Ransomware | MINEMAN Systems id8501 View details | Manufacturing / Engineering | — | |||
|
MINEMAN IS THE TRUSTED INDUSTRY STANDARD FOR THE MARKETING OF CONCENTRATES AND METALS FROM MINING. |
||||||
| Ransomware | Promotrans id8500 View details | France | Communication / Marketing | — | ||
|
Promotrans is a company that operates in the Professional Training & Coaching industry. It employs 251-500 people and has $25M-$50M of revenue. The company is headquartered in Paris, Île-de-france, France. |
||||||
| Ransomware | Seymours id8499 View details | United Kingdom | Construction / Real Estate | — | ||
|
Surrey estate agents Seymours have six offices in Surrey located in Ripley, Guildford, Burpham, Woking and West Byfleet, one being a specialist letting & management operation dealing with properties for sale |
||||||
| Ransomware | Marfrig Global Foods id8496 View details | Brazil | Agriculture / Food | — | ||
|
Established in 2000, Marfrig Global Foods processes beef products. They have processing locations in various countries and regions. |
||||||
| Ransomware | Barsco id8493 View details | Hospitality / Food & Beverage / Tourism | — | |||
|
Texas located Heating, Ventilation, Air Conditioning, and Refrigeration wholesale supplier. Since 1934 and under many names Barsco has been atop the HVAC/R industry. Centered in Dallas, Barsco operates across the North, East, and Central Texas frontiers. |
||||||
| Ransomware | Foroni SPA id8492 View details | Manufacturing / Engineering | — | |||
|
Foroni S.p.A. is a fully integrated manufacturer of Nickel based and Specialty alloys in a wide range of chemistries for a variety of industrial applications. |
||||||
| Ransomware | Hornsyld Købmandsgaard id8491 View details | Denmark | Agriculture / Food | — | ||
|
Hornsyld Købmandsgaard is a company that operates in the Farming industry. It employs 21-50 people and has $10M-$25M of revenue. The company is headquartered in Hornsyld, Region Midtjylland, Denmark. |
||||||
| Ransomware | Lagarde Meregnani id8490 View details | France | Construction / Real Estate | — | ||
|
Lagarde Meregnani. BUILDING FINISHING COMPANY. Lagarde Meregnani works on new construction or renovation sites in painting and decoration, floor coverings and wall coverings, facade renovation, exterior insulation, tiles and earthenware, etc.Whether it concerns construction sites for professionals or private individuals, Lagarde Meregnani manages all trades and thus coordinates interventions as well as possible, in the Grand Est and throughout France. |
||||||
| Ransomware | Balcan id8468 View details | Canada | IT | — | — | |
|
Founded in 1967 and headquartered in Montreal, Canada, Balcan is a manufacturer and distributor of technical films and flexible packaging. |
||||||
| Ransomware | Barco Uniforms id8467 View details | Hospitality / Food & Beverage / Tourism | — | — | ||
|
Founded in 1929, Barco Uniforms is a leader of design innovation in the premium professional apparel industry, offering award-winning premium uniforms that elevate and honor the individuals in the healthcare, enterprise, and food service industries. |
||||||
| Ransomware | Alberto Couto Alves id7401 View details | Construction / Real Estate | — | |||
|
ACA Engenharia & Construção operates in a wide range of areas from Roads and Infrastructures, Buildings to the production of Bituminous mixtures, Concrete and Aggregates. |
||||||
| Ransomware | Agoravita id7400 View details | IT | — | |||
|
Since 1999, Agoravita has supported companies in their infrastructure projects and IT services, digital communications, software development and training, which form the basis of their digital transition. |
||||||
| Ransomware | American Meteorological Society id7399 View details | NGOs / Associations | — | |||
|
The American Meteorological Society, founded in 1919, is a global community committed to advancing weather, water, and climate science and service. |
||||||
| Ransomware | Biocair International id7398 View details | Healthcare / Pharma | — | |||
|
Biocair is a global GDP logistics specialist with over 35 years of experience in the pharmaceutical, biotechnology and life sciences sectors. |
||||||
| Ransomware | Confartigianato Federimpresa FC id7397 View details | Communication / Marketing | — | |||
|
Confartigianato Federimpresa FC is a company that operates in the Financial Services industry. |
||||||
| Ransomware | ScanSource id7396 View details | IT | — | |||
|
Founded in 1992, ScanSource, Inc is an international distributor of technology products and solutions, focusing on point-of-sale (POS), payments, barcode, physical security, unified communications and collaboration, cloud and telecom services. |
||||||
| Ransomware | CWS id7395 View details | IT | — | |||
|
CWS Srl is a company that operates in the Information Technology and Services industry. |
||||||
| Ransomware | Hawa Sliding Solutions id7394 View details | Communication / Marketing | — | |||
|
Hawa AG has been producing sliding solutions for creative building culture for more than 50 years. It is well-known as a premium provider of sliding fitting systems for equipment, room partitioning, shop fronts and facades. |
||||||
| Ransomware | Imagination id7393 View details | Other | — | |||
|
Imagination is an independent experience company with 12 offices worldwide. We specialise in designing experiences which change how people feel, think and act. |
||||||
| Ransomware | Italkraft id7392 View details | Communication / Marketing | — | |||
|
Headquartered in Miami, Florida, we provide our customers with Italian Design kitchen, bathroom and closet cabinetry of the highest standard and style. |
||||||
| Ransomware | Michigan Production Machining id7391 View details | United States | Manufacturing / Engineering | — | ||
|
Michigan Production Machining, Inc. manufactures induction heat treating supplies. The company offers precision machined ferrous and non-ferrous forgings and castings to the automotive industry. Michigan Production Machining operates in the United States. |
||||||
| Ransomware | Novobit id7390 View details | Communication / Marketing | — | |||
|
Novobit AG is a well-established and fully independent company that develops and manufactures a wide range of fiber optic products for the global market. |
||||||
| Ransomware | Artemide id7389 View details | Italy | Manufacturing / Engineering | — | ||
|
Artemide, headquartered in Lombardy, Italy, is a company that specializes in the design, manufacturing, and retail of residential light fixtures. |
||||||
| Ransomware | Reyes Automotive Group id7388 View details | Manufacturing / Engineering | — | |||
|
Reyes Automotive Group is a minority owned Joint Venture (or JV) that is comprised of two companies with a combined 120 years of manufacturing experience. |
||||||
| Ransomware | Rotomail Italia SpA id7387 View details | Communication / Marketing | — | |||
|
Rotomail Italia SpA is a company that operates in the Printing industry. |
||||||
| Ransomware | Phoenix Taxis id7386 View details | Other | — | |||
|
Phoenix Taxis are Northumberland's largest taxi company, operating a service throughout the North East dedicated to quality vehicles and reliable customer service. |
||||||
| Ransomware | Wasserstrom id7385 View details | Hospitality / Food & Beverage / Tourism | — | |||
|
The Wasserstrom Company, headquartered in Columbus, Ohio and founded in 1902, is a restaurant supplier and distributor of foodservice supplies and equipment. They sell products, such as kitchen supplies and catering supplies, from industry manufacturers. |
||||||
| Ransomware | Americold id7384 View details | United States | Construction / Real Estate | — | ||
|
AmeriCold Logistics LLC is a major temperature controlled warehousing and transportation company based in Atlanta, Georgia, United States. It is in the business of modern commercialized temperature-controlled warehousing for the storage of perishable goods. |
||||||