cactus
First seen July 20, 2023Active248 claimed victims
The claims below are reproduced as posted by cactus on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure. There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| jmthompson.com | May 25, 2024 | ransomware_live | — |
| familyguardian.com | May 22, 2024 | ransomware_live | — |
| transportlaberge.com | May 22, 2024 | ransomware_live | — |
| espackeuro.com | May 21, 2024 | ransomware_live | — |
| schuettemetals.com | May 20, 2024 | ransomware_live | — |
| dollmar.com | May 17, 2024 | ransomware_live | — |
| suminoe.us | May 13, 2024 | ransomware_live | — |
| daystar.com | May 2, 2024 | ransomware_live | — |
| sanyo-shokai.co.jp | April 25, 2024 | ransomware_live | — |
| saglobal.com | April 19, 2024 | ransomware_live | — |
| iddink.nl | April 11, 2024 | ransomware_live | — |
| fulcrum.pro | April 10, 2024 | ransomware_live | — |
| scanda.com.mx | April 9, 2024 | ransomware_live | — |
| acfin.cl | April 4, 2024 | ransomware_live | — |
| xdconnects.com | April 2, 2024 | ransomware_live | — |
| regencyfurniture.com | March 23, 2024 | ransomware_live | — |
| regulatormarine.com | March 19, 2024 | ransomware_live | — |
| eclinicalsol.com | March 18, 2024 | ransomware_live | — |
| besttrans.com | March 18, 2024 | ransomware_live | — |
| aerodynamicinc.com | March 18, 2024 | ransomware_live | — |
| kelson.on.ca | March 12, 2024 | ransomware_live | — |
| drmarbys.com | March 11, 2024 | ransomware_live | — |
| contenderboats.com | March 4, 2024 | ransomware_live | — |
| newagesys.com | February 29, 2024 | ransomware_live | — |
| abtexelgroup.com | February 28, 2024 | ransomware_live | — |
| renypicot.es | February 27, 2024 | ransomware_live | — |
| qosina.com | February 27, 2024 | ransomware_live | — |
| mcalvain.com | February 27, 2024 | ransomware_live | — |
| grupatopex.com | February 23, 2024 | ransomware_live | — |
| cleshar.co.uk | February 19, 2024 | ransomware_live | — |
| ammega.com | February 16, 2024 | ransomware_live | — |
| advancedprosolutions.com | January 30, 2024 | ransomware_live | — |
| remkes.nl | January 29, 2024 | ransomware_live | — |
| oogp.com | January 27, 2024 | ransomware_live | — |
| jaygroup.com | January 26, 2024 | ransomware_live | — |
| plymouth.com | January 26, 2024 | ransomware_live | — |
| gocco.com | January 19, 2024 | ransomware_live | — |
| spbglobal.com | January 17, 2024 | ransomware_live | — |
| parksite.com | January 17, 2024 | ransomware_live | — |
| se.com | January 17, 2024 | ransomware_live | — |
| northernresponse.com | January 17, 2024 | ransomware_live | — |
| steelwarehouse.com | January 17, 2024 | ransomware_live | — |
| acutis.com | January 12, 2024 | ransomware_live | — |
| asburyauto.com | January 12, 2024 | ransomware_live | — |
| gdi.com | December 28, 2023 | ransomware_live | — |
| bellgroup.co.uk | December 22, 2023 | ransomware_live | — |
| coop.se | December 21, 2023 | ransomware_live | — |
| tridon.com.au | December 19, 2023 | ransomware_live | — |
| hi-cone.com | December 18, 2023 | ransomware_live | — |
| intercityinvestments.com | December 16, 2023 | ransomware_live | — |
| dtsolutions.net | December 16, 2023 | ransomware_live | — |
| pbssystems.com | December 8, 2023 | ransomware_live | — |
| National Nail Corp | December 7, 2023 | ransomware_live | — |
| wkw-group.com | December 6, 2023 | ransomware_live | — |
| bachoco.com.mx | December 5, 2023 | ransomware_live | — |
| concordegroup.ca | December 4, 2023 | ransomware_live | — |
| Dillard Door & Security | November 30, 2023 | ransomware_live | — |
| DILLARD | November 30, 2023 | ransomware_live | — |
| dillarddoor.com | November 30, 2023 | ransomware_live | — |
| Axiom Construction & Consulting | November 28, 2023 | ransomware_live | — |
| FYIdoctors | November 28, 2023 | ransomware_live | — |
| larlyn.com | November 28, 2023 | ransomware_live | — |
| quakerwindows.com | November 25, 2023 | ransomware_live | — |
| hunterbuildings.com | November 24, 2023 | ransomware_live | — |
| dbmgroup.com | November 23, 2023 | ransomware_live | — |
| Petersen Health Care | November 21, 2023 | ransomware_live | — |
| Verhelst | November 21, 2023 | ransomware_live | — |
| CTS | November 21, 2023 | ransomware_live | — |
| cts.co.uk | November 21, 2023 | ransomware_live | — |
| ISC Consulting Engineers | November 17, 2023 | ransomware_live | — |
| ISC | November 17, 2023 | ransomware_live | — |
| NNDOMAIN | November 14, 2023 | ransomware_live | — |
| CIE Automotive | November 7, 2023 | ransomware_live | — |
| CIE | November 7, 2023 | ransomware_live | — |
| LAJOLLAGROUP | November 7, 2023 | ransomware_live | — |
| UTI Group | November 6, 2023 | ransomware_live | — |
| GEOCOM | November 6, 2023 | ransomware_live | — |
| coastalcargogroup.com | November 6, 2023 | ransomware_live | — |
| Medi-Market | October 31, 2023 | ransomware_live | — |
| MEDIMARKET | October 31, 2023 | ransomware_live | — |
| Paul Stuart | October 28, 2023 | ransomware_live | — |
| SCS SpA | October 16, 2023 | ransomware_live | — |
| www.glynmarais.co.za | October 12, 2023 | ransomware_live | — |
| Odalys Vacances | October 10, 2023 | ransomware_live | — |
| ODALYS | October 10, 2023 | ransomware_live | — |
| MultiMasters | October 9, 2023 | ransomware_live | — |
| The Hurley Group | October 7, 2023 | ransomware_live | — |
| sofidel.com | October 6, 2023 | ransomware_live | — |
| RICOR Global Limited | October 5, 2023 | ransomware_live | — |
| Cornerstone Projects Group | October 5, 2023 | ransomware_live | — |
| Unitex Textile Rental Services | September 27, 2023 | ransomware_live | — |
| UTC Overseas | September 27, 2023 | ransomware_live | — |
| Orthum Bau | September 26, 2023 | ransomware_live | — |
| OmniVision Technologies | September 26, 2023 | ransomware_live | — |
| sky-light.com | September 25, 2023 | ransomware_live | — |
| hundhausen.de | September 15, 2023 | ransomware_live | — |
| Levine Bagade Han | September 11, 2023 | ransomware_live | — |
| Wardlaw Claims Service | September 11, 2023 | ransomware_live | — |
| JSS Almonds | September 8, 2023 | ransomware_live | — |
| Geo Tek | September 8, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).