Cactus is a ransomware-as-a-service (RaaS) operation that emerged in March 2023, primarily motivated by financial gain through a double extortion model. The group distinguishes itself by encrypting its own binary to evade detection, which it only unpacks when executed. While its exact origin remains unknown, some researchers speculate connections to Russia or a Malaysian hacktivist group. Cactus operators have demonstrated an evolving operational model, with evidence in January 2025 suggesting a potential transition or close affiliation of members from the Black Basta ransomware group, indicating a shared use of tactics, techniques, and procedures.

Aliases del actor

CactusPeteTonto TeamBisonalLone Rangerotros mencionados en fuentes OSINT verificadasbisonaltontotontoteamG0131 o Seven Pointed DaggerBisonal (malware)Dissident groupsotros referencias en inteligencia de amenzas

Actores similares

bisonalactor · 1Tonto Teamapt · 1tonto-teamactor · 1malware---toolsactor · 54auditteamactor · 16malwrhunterteamactor · 11audit-teamactor · 2AuditTeamactor · 2aztroteamransomware · 2fsteamransomware · 2

Paises afectados

URLs nuevas detectadas en IntelTracker