The Stealthy CACTUS Ransomware Menace: Exploiting VPN Appliance Flaws and Targeting Large Corporations

Ransomware is a growing concern for companies of all sizes, and cybersecurity researchers have recently shed light on a new strain called CACTUS. This ransomware has been targeting large commercial entities since March 2021, and it has been observed to leverage known flaws in VPN appliances to gain initial access to targeted networks. Once inside, it employs double extortion tactics to steal sensitive data and demands payment in exchange for a decryption key.

Exploitation of vulnerable VPN devices sets the stage

CACTUS begins its attack by exploiting known vulnerabilities in VPN devices to set up an SSH backdoor. Once this initial access is established, the attacker executes a series of PowerShell commands to conduct network scanning and identify a list of machines to encrypt. These commands also allow the attacker to maintain persistent access to the network, making it more difficult for the victim to detect and remove the ransomware.

Using sophisticated tools for command and control

CACTUS also utilizes sophisticated tools for command and control, including the popular penetration testing framework Cobalt Strike and a tunneling tool referred to as Chisel. The ransomware authors also make use of Remote Monitoring and Management (RMM) software like AnyDesk, allowing them to remotely control the infected machines and monitor their progress.

A unique batch script evades detection

One unique aspect of CACTUS is the use of a batch script to extract the ransomware binary with 7-Zip. This process makes it harder to detect as the ransomware essentially encrypts itself, removing the .7z archive before executing the payload. This technique allows CACTUS to evade antivirus and network monitoring tools, making it more challenging for defenders to detect and remove.

Insights from cybersecurity experts

Laurie Iacono, Associate Managing Director for Cyber Risk at Kroll, commented on the unique features of CACTUS. She notes that the ransomware’s ability to encrypt itself makes it more challenging to detect, and that this demonstrates the importance of continual adaptation by cybersecurity professionals to keep up with evolving threats.

Comparison to other ransomware families

The emergence of CACTUS comes just days after Trend Micro shed light on another type of ransomware known as Rapture. This new ransomware shares some similarities with other families, such as Paradise. The use of vulnerable public-facing websites and servers is a common tactic for ransomware authors looking to gain access to corporate networks. This makes it essential for organizations to keep their systems up-to-date and enforce the principle of least privilege (PoLP).

The rising trend of new ransomware families

CACTUS and Rapture are the latest additions to a long list of new ransomware families that have come to light in recent weeks. Other examples include Gazprom, BlackBit, UNIZA, Akira, and a NoCry ransomware variant called Kadavro Vector. This trend demonstrates the continued evolution of ransomware as a significant threat to organizations worldwide.

The emergence of CACTUS and other new ransomware families highlights the critical need for organizations to stay vigilant and proactive in their approach to cybersecurity. Companies must prioritize continuous monitoring of their systems, implement regular patching and updates, and enforce the Principle of Least Privilege (PoLP) to limit the impact of ransomware attacks. As ransomware authors continue to develop new tactics and tools, it is essential for defenders to remain one step ahead and continuously adapt their strategies to keep pace with evolving threats.

Explore more

How Is Mastercard Shaping the Future of E-Commerce by 2030?

In an era where digital transactions are becoming the backbone of global trade, Mastercard stands as a pivotal force driving the evolution of e-commerce toward a transformative horizon by 2030. The rapid advancement of technology, coupled with shifting consumer behaviors and economic dynamics, is setting the stage for a future where billions of interconnected devices and autonomous agents could redefine

Browser Extensions for E-Commerce – Review

Setting the Stage for Digital Shopping Innovation Imagine a world where every online purchase is optimized for savings, personalized to individual preferences, and seamlessly integrated with real-time market insights—all at the click of a button. In 2025, browser extensions for e-commerce have made this vision a reality, transforming the way millions of consumers shop and how retailers strategize. These compact

AI in Banking – Review

Imagine a world where banking services are available at the touch of a button, any hour of the day, with transactions processed in mere seconds and fraud detected before it even happens. This is no longer a distant dream but a reality shaped by artificial intelligence (AI) in the banking sector. As digital transformation accelerates, AI has emerged as a

Snowflake’s Cortex AI Revolutionizes Financial Services

Diving into the intricate world of data privacy and web technology, we’re thrilled to chat with Nicholas Braiden, a seasoned FinTech expert and early adopter of blockchain technology. With a deep passion for the transformative power of financial technology, Nicholas has guided numerous startups in harnessing cutting-edge tools to innovate within the digital payment and lending space. Today, we’re shifting

Why Is Python the Go-To Language for Data Science?

What if a single tool could transform raw numbers into world-changing insights with just a few lines of code? In today’s data-driven landscape, Python has become that tool, powering everything from small business analytics to groundbreaking AI innovations at tech giants. This programming language, celebrated for its simplicity and strength, stands at the heart of data science—a field that shapes