Cactus Ransomware

Cactus ransomware, emerging around March 2023, has quickly become a significant threat in the cyber landscape. This ransomware strain employs double-extortion tactics, encrypting victims' data and threatening to leak it publicly if a ransom is not paid. Cactus is notable for its rapid exploitation of known vulnerabilities, particularly in VPN appliances and, more recently, in Qlik Sense software. This, combined with its use of sophisticated techniques to evade detection and achieve persistence, makes Cactus a formidable adversary for organizations of all sizes. The "digital kidnapping" of data and systems for financial gain is the core principle, and Cactus embodies this with its aggressive tactics.

Origins & Evolution

Cactus ransomware was first identified and tracked around March 2023. The name derives from the ransom note filename, "cAcTuS.readme.txt," and the file extension appended to encrypted files, ".cts[number]". While a relatively new entrant, Cactus has quickly targeted large commercial organizations, demonstrating a capacity for high-impact attacks.

While definitive attribution is challenging, Cactus shares some characteristics with other ransomware families. Some researchers have observed similarities in TTPs (Tactics, Techniques, and Procedures) with groups like BLACKBASTA, particularly in the use of the TotalExec.ps1 script for automated deployment. The Bitdefender report discusses potential early activity involving Kinsing, known for cryptojacking. The ransomware's encryption scheme, using a key to decrypt itself, suggests a level of sophistication to avoid anti-virus detection (Kroll). The usage of CVEs so soon after their release, also puts them in the same ballpark as other threat actors.

The evolution of Cactus is evident in its shifting initial access vectors. Initially, the exploitation of VPN vulnerabilities, specifically in Fortinet appliances (CVE-2023-38035), was a common entry point. More recently, Cactus operators have been observed exploiting vulnerabilities in Qlik Sense software (CVE-2023-41266, CVE-2023-41265, and CVE-2023-48365), demonstrating an ability to adapt to new targets and exploit newly discovered weaknesses rapidly. The attack also expanded to include virtualization infrastructure (ESXi and Hyper-V).

Tactics & Techniques

Cactus ransomware employs a multi-stage attack chain, leveraging various techniques to infiltrate networks, establish persistence, exfiltrate data, and ultimately encrypt files. Here's a breakdown of key TTPs:

* Network scanning using tools like SoftPerfect Network Scanner and PSNmap tool (PSnmap.ps1) is used to gather IP addresses, enumerate endpoints, identify users, and check for active machines.

* Installs Remote Monitoring and Management (RMM) tools, such as AnyDesk and Splashtop, for persistent access and payload delivery. Learn about what are RMM tools.

* Cactus uses credential harvesting techniques, including LSASS credential dumping. Credentials are also dumped from web browsers and password files on disk.

* RDP (Remote Desktop Protocol) is used for lateral movement, leveraging valid or newly created accounts.

* Remote management tools, such as SuperOps RMM, are also utilized.

* Cactus attempts to disable or modify anti-virus software. This is often done via batch scripts and, in some cases, by using the anti-virus software's own uninstaller.

* f1.bat script is used to create a new administrator user account (e.g., Adm1nBac).

* The encryptor binary is packed (UPX) and requires a key to decrypt and execute, hindering analysis and detection. One way to look for any IOC is threat intelligence.

* Cactus executes TotalExec.ps1 remotely on discovered devices. This script, in turn, executes f1.bat, f2.bat, and the ransomware payload.

* The ransomware uses a combination of RSA and AES encryption (AES_CBC_256 + RSA_4096). For files larger than 7.7MB, partial encryption is employed.

* Encrypted files receive the extension ".cts[number]".

* Ransom notes, named "cAcTuS.readme.txt," are dropped in every processed folder.

Payload Analysis and Execution Flow

Targets or Victimology

Cactus ransomware primarily targets large commercial organizations. While potentially opportunistic, the group has demonstrated a willingness to target high-profile victims, including multinational corporations. This suggests a focus on targets with the potential for significant ransom payments and valuable data for extortion.

Industries targeted have included:

The geographical scope of Cactus attacks appears to be broad. Schneider Electric, a French company with global operations, was targeted, suggesting a willingness to operate internationally. The Bitdefender report details attacks on two companies, one being US-based and the other having a strong presence in Europe.

Cactus's double-extortion tactics indicate a primary motivation of financial gain. The threat of leaking stolen data, coupled with the encryption of critical systems, significantly increases the pressure on victims to pay the ransom.

Attack Campaigns

Several notable attack campaigns have been attributed to Cactus ransomware:

Defenses

Combating Cactus ransomware requires a multi-layered approach, combining proactive prevention with robust detection and response capabilities. Key defense strategies include:

Conclusion

Cactus ransomware represents a significant and evolving threat to organizations, particularly those with valuable data and critical infrastructure. Its rapid exploitation of vulnerabilities, sophisticated techniques, and double-extortion tactics make it a formidable adversary. By understanding Cactus's TTPs, targets, and attack campaigns, organizations can implement effective defenses to mitigate the risk of infection and minimize the impact of a successful attack. A proactive, multi-layered security approach, combining robust vulnerability management, strong access controls, advanced detection capabilities, and comprehensive incident response planning, is crucial for staying ahead of this and other emerging ransomware threats. Constant vigilance and adaptation are key in the ongoing battle against ransomware.

Found this article interesting? Keep visit thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive tips like this. 

You may also like these articles: