Cactus is a ransomware-as-a-service (RaaS) operation that emerged in March 2023, primarily motivated by financial gain through a double extortion model. The group distinguishes itself by encrypting its own binary to evade detection, which it only unpacks when executed. While its exact origin remains unknown, some researchers speculate connections to Russia or a Malaysian hacktivist group. Cactus operators have demonstrated an evolving operational model, with evidence in January 2025 suggesting a potential transition or close affiliation of members from the Black Basta ransomware group, indicating a shared use of tactics, techniques, and procedures.

Aliases del actor

CactusPeteG0131 o Seven Pointed DaggerTonto TeamBisonal (malware)Lone RangerDissident groupsotros referencias en inteligencia de amenzasBisonalotros mencionados en fuentes OSINT verificadasbisonaltontotontoteam

Actores similares

tonto-teamactor · 1bisonalactor · 1Tonto Teamthreat-actor · 1malware---toolsactor · 54auditteamactor · 16malwrhunterteamactor · 11AuditTeamthreat-actor · 2aztroteamthreat-actor · 2fsteamthreat-actor · 2malekteamthreat-actor · 2

Paises afectados

URLs nuevas detectadas en IntelTracker