cactus
First seen July 20, 2023Active248 claimed victims
The claims below are reproduced as posted by cactus on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure. There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Specialised Management Services | September 7, 2023 | ransomware_live | — |
| Trimaran Capital Partners | September 7, 2023 | ransomware_live | — |
| West Craft Manufacturing | September 7, 2023 | ransomware_live | — |
| TORMAX USA | September 7, 2023 | ransomware_live | — |
| reawire.com | September 6, 2023 | ransomware_live | — |
| Lagarde Meregnani | September 5, 2023 | ransomware_live | — |
| Hornsyld Købmandsgaard | September 5, 2023 | ransomware_live | — |
| Foroni SPA | September 5, 2023 | ransomware_live | — |
| Barsco | September 5, 2023 | ransomware_live | — |
| Marfrig Global Foods | September 5, 2023 | ransomware_live | — |
| Seymours | September 5, 2023 | ransomware_live | — |
| Promotrans | September 5, 2023 | ransomware_live | — |
| MINEMAN Systems | September 5, 2023 | ransomware_live | — |
| Maxxd Trailers | September 5, 2023 | ransomware_live | — |
| Barco Uniforms | September 4, 2023 | ransomware_live | — |
| Balcan | September 4, 2023 | ransomware_live | — |
| Spuncast | September 2, 2023 | ransomware_live | — |
| Astro Lighting | September 2, 2023 | ransomware_live | — |
| Peacock Bros | September 1, 2023 | ransomware_live | — |
| ghimli.com | August 26, 2023 | ransomware_live | — |
| Bacon Universal | August 22, 2023 | ransomware_live | — |
| BRiC Partnership | August 17, 2023 | ransomware_live | — |
| atWork Office Furniture | August 11, 2023 | ransomware_live | — |
| Custom Powder Systems | August 11, 2023 | ransomware_live | — |
| Leekes | August 9, 2023 | ransomware_live | — |
| DM Civil | August 8, 2023 | ransomware_live | — |
| Unimarketing | August 3, 2023 | ransomware_live | — |
| My Insurance Broker | August 2, 2023 | ransomware_live | — |
| Americold | July 20, 2023 | ransomware_live | — |
| Wasserstrom | July 20, 2023 | ransomware_live | — |
| Phoenix Taxis | July 20, 2023 | ransomware_live | — |
| Rotomail Italia SpA | July 20, 2023 | ransomware_live | — |
| Reyes Automotive Group | July 20, 2023 | ransomware_live | — |
| Artemide | July 20, 2023 | ransomware_live | — |
| Novobit | July 20, 2023 | ransomware_live | — |
| Michigan Production Machining | July 20, 2023 | ransomware_live | — |
| Italkraft | July 20, 2023 | ransomware_live | — |
| Imagination | July 20, 2023 | ransomware_live | — |
| Hawa Sliding Solutions | July 20, 2023 | ransomware_live | — |
| CWS | July 20, 2023 | ransomware_live | — |
| ScanSource | July 20, 2023 | ransomware_live | — |
| Confartigianato Federimpresa FC | July 20, 2023 | ransomware_live | — |
| Biocair International | July 20, 2023 | ransomware_live | — |
| American Meteorological Society | July 20, 2023 | ransomware_live | — |
| Agoravita | July 20, 2023 | ransomware_live | — |
| Alberto Couto Alves | July 20, 2023 | ransomware_live | — |
| ebir.com | July 19, 2023 | ransomware_live | — |
| millimages.com | July 3, 2023 | ransomware_live | — |
← NewerPage 3 of 3
Claim data from ransomware.live and RansomLook (CC BY 4.0).