cactus
First seen July 20, 2023Active248 claimed victims
The claims below are reproduced as posted by cactus on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure. There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| kyb.com | March 17, 2025 | ransomware_live | — |
| assaabloy.com | March 17, 2025 | ransomware_live | — |
| baillie.com | March 12, 2025 | ransomware_live | — |
| quigleyeye.com | March 3, 2025 | ransomware_live | — |
| rocketstores.com | February 26, 2025 | ransomware_live | — |
| lifting.com | February 25, 2025 | ransomware_live | — |
| urban1.com | February 25, 2025 | ransomware_live | — |
| branchgroup.com | February 24, 2025 | ransomware_live | — |
| chfindustries.com | February 24, 2025 | ransomware_live | — |
| This entry has been removed following a request from the company. | February 17, 2025 | ransomware_live | — |
| bluedge.com | February 17, 2025 | ransomware_live | — |
| regulvar.com | February 16, 2025 | ransomware_live | — |
| britannicahome.com | February 12, 2025 | ransomware_live | — |
| everelgroup.com | February 12, 2025 | ransomware_live | — |
| thermoid.com | February 12, 2025 | ransomware_live | — |
| tempel.com | February 9, 2025 | ransomware_live | — |
| pace-usa.com | February 6, 2025 | ransomware_live | — |
| grede.com | February 6, 2025 | ransomware_live | — |
| associatedasset.com | February 6, 2025 | ransomware_live | — |
| amalgamatedsugar.com | February 6, 2025 | ransomware_live | — |
| formanmills.com | February 6, 2025 | ransomware_live | — |
| aiibeauty.com | February 6, 2025 | ransomware_live | — |
| alphabaking.com | February 6, 2025 | ransomware_live | — |
| caltrol.com | February 6, 2025 | ransomware_live | — |
| ssmcoop.com | February 5, 2025 | ransomware_live | — |
| almostfamousclothing.com | February 5, 2025 | ransomware_live | — |
| steelerubber.com | February 5, 2025 | ransomware_live | — |
| uniekinc.com | February 5, 2025 | ransomware_live | — |
| bestbrands.com | February 3, 2025 | ransomware_live | — |
| electrocraft.com | January 30, 2025 | ransomware_live | — |
| holtcat.com | January 30, 2025 | ransomware_live | — |
| stanleyconsultants.com | January 30, 2025 | ransomware_live | — |
| uniquehd.com | January 29, 2025 | ransomware_live | — |
| savoiesfoods.com | January 28, 2025 | ransomware_live | — |
| rashtiandrashti.com | January 24, 2025 | ransomware_live | — |
| mgainnovation.com | January 23, 2025 | ransomware_live | — |
| sunrise-soya.com | January 21, 2025 | ransomware_live | — |
| curtisint.com | January 21, 2025 | ransomware_live | — |
| newhorizonsbaking.com | January 21, 2025 | ransomware_live | — |
| vsstransportationgroup.com | January 17, 2025 | ransomware_live | — |
| johnpaulrichard.com | January 16, 2025 | ransomware_live | — |
| jayaapparelgroup.com | January 16, 2025 | ransomware_live | — |
| alkodistributors.com | January 16, 2025 | ransomware_live | — |
| midwayimporting.com | January 16, 2025 | ransomware_live | — |
| revitalash.com | January 15, 2025 | ransomware_live | — |
| ttucorp.com | January 14, 2025 | ransomware_live | — |
| kinseysinc.com | January 14, 2025 | ransomware_live | — |
| biagibros.com | January 9, 2025 | ransomware_live | — |
| optiline.com | December 25, 2024 | ransomware_live | — |
| cornwelltools.com | December 18, 2024 | ransomware_live | — |
| fplfood.com | December 16, 2024 | ransomware_live | — |
| galatachemicals.com | December 12, 2024 | ransomware_live | — |
| adveo.com | December 4, 2024 | ransomware_live | — |
| massdevelopment.com | November 29, 2024 | ransomware_live | — |
| ptcky.com | November 17, 2024 | ransomware_live | — |
| awimc.com | November 11, 2024 | ransomware_live | — |
| ottosimon.co.uk | October 30, 2024 | ransomware_live | — |
| picsolve.com | October 24, 2024 | ransomware_live | — |
| lumiplan.com | October 18, 2024 | ransomware_live | — |
| synertrade.com | October 16, 2024 | ransomware_live | — |
| lsst.ac | October 15, 2024 | ransomware_live | — |
| bcllegal.com | October 10, 2024 | ransomware_live | — |
| hacla.org | October 1, 2024 | ransomware_live | — |
| matki.co.uk | September 19, 2024 | ransomware_live | — |
| www.amchar.com | September 17, 2024 | ransomware_live | — |
| kjtait.com | September 12, 2024 | ransomware_live | — |
| hindlegroup.com | September 10, 2024 | ransomware_live | — |
| www.galab.com | September 8, 2024 | ransomware_live | — |
| actionfirepros.com | September 4, 2024 | ransomware_live | — |
| thomas-lloyd.com | September 3, 2024 | ransomware_live | — |
| peerlessumbrella.com | August 30, 2024 | ransomware_live | — |
| ten8fire.com | August 30, 2024 | ransomware_live | — |
| riomarineinc.com | August 7, 2024 | ransomware_live | — |
| rangeramerican.com | August 5, 2024 | ransomware_live | — |
| natcoglobal.com | August 1, 2024 | ransomware_live | — |
| simson-maxwell.com | July 30, 2024 | ransomware_live | — |
| mcphillips.co.uk | July 23, 2024 | ransomware_live | — |
| flodraulic.com | July 23, 2024 | ransomware_live | — |
| balboabayresort.com | July 19, 2024 | ransomware_live | — |
| champeau.com | July 19, 2024 | ransomware_live | — |
| denkaiamerica.com | July 17, 2024 | ransomware_live | — |
| exco-solutions.com | July 17, 2024 | ransomware_live | — |
| dahlvalve.com | July 10, 2024 | ransomware_live | — |
| mihlfeld.com | July 9, 2024 | ransomware_live | — |
| tibaitservices.com | July 6, 2024 | ransomware_live | — |
| securityinstrument.com | July 6, 2024 | ransomware_live | — |
| westernwyomingbeverages.com | July 5, 2024 | ransomware_live | — |
| leonardssyrups.com | July 5, 2024 | ransomware_live | — |
| verco.co.uk | July 2, 2024 | ransomware_live | — |
| corporatejobbank.com | June 29, 2024 | ransomware_live | — |
| demos.fr | June 28, 2024 | ransomware_live | — |
| westfalia-automotive.com | June 24, 2024 | ransomware_live | — |
| hydmech.com | June 24, 2024 | ransomware_live | — |
| chubb-bulleid.co.uk | June 19, 2024 | ransomware_live | — |
| isometrix.com | June 2, 2024 | ransomware_live | — |
| fbttransport.com | June 1, 2024 | ransomware_live | — |
| fpr-us.com | May 30, 2024 | ransomware_live | — |
| deskcenter.com | May 29, 2024 | ransomware_live | — |
| ctgbrands.com | May 28, 2024 | ransomware_live | — |
| ctsystem.com | May 28, 2024 | ransomware_live | — |
Page 1 of 3Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).