By 
Researchers from cybersecurity firm Kroll warns of a new ransomware family called CACTUS which was found exploiting known flaws in VPN appliances to gain initial access to targeted networks.
The new ransomware operation that has been active since March 2023 uses a double-extortion model.
The new ransomware strain outstands for the use of encryption to protect the ransomware binary. The threat actor uses a batch script to obtain the encryptor binary using 7-Zip.
The binary is deployed using a specific flag that allows its execution, while the ZIP archive is removed. This technique allows the encryptor to avoid detection.
Laurie Iacono, Associate Managing Director for Cyber Risk at Kroll stated that CACTUS essentially encrypts itself, making it harder to detect and helping it evade antivirus and network monitoring tools.
Once gaining access to the network, the ransomware operators uses a scheduled task to maintain persistence via an SSH backdoor.
Cactus ransomware uses the SoftPerfect Network Scanner (netscan) to look for other targets on the network along with PowerShell commands to enumerate endpoints. The ransomware identifies user accounts by viewing successful logins in Windows Event Viewer, it also uses a modified variant of the open-source PSnmap Tool.
The ransomware relies on multiple legitimate tools (e.g. Splashtop, AnyDesk, SuperOps RMM) to achieve remote access and uses Cobalt Strike and the proxy tool Chisel in post-exploitation activities.
Once escalated the privileges on a machine, the threat actors use a batch script to uninstall popular antivirus solutions installed on the machine.
Cactus uses the Rclone tool for data exfiltration and used a PowerShell script called TotalExec, which was used in the past by BlackBasta ransomware operators, to automate the deployment of the encryption process.
At the moment there is no public information about the ransoms that Cactus demands from its victims.
