Cactus ransomware

Cactus ransomware is a double-extortion operation active since March 2023 that targets large organizations. Its operators break into a network, steal data, and then encrypt systems, leaving the affected organization facing both an outage and the threat of data publication. Cactus is a big-game operation rather than a mass-market threat. Its operators usually gain access by exploiting vulnerabilities in internet-facing equipment, particularly network edge devices and business software exposed to the internet. Stolen credentials and social engineering, including impersonation through workplace chat, are also reported entry routes. The operation's most distinctive technical trait is self-encryption. The ransomware payload arrives in an encrypted form and requires a key supplied at execution time before it can unpack. A security tool inspecting the file may find no recognizable ransomware code. That protection applies to the file, not to the behavior that follows. Once running, Cactus still has to disable security tools, move through the environment, steal data, and modify files at scale.

Key takeaways

Cactus is a double-extortion operation. Data is stolen before encryption, so restoring systems does not remove the threat of publication.
It targets large organizations. Cactus is a big-game operation aimed at enterprises rather than individuals or mass distribution.
Its entry point is usually exposed infrastructure. Vulnerabilities in internet-facing edge devices and business software, along with stolen credentials and social engineering, provide the main routes in.
The ransomware encrypts itself to evade file inspection. The payload remains unreadable until it receives a key at runtime, which limits file-based detection.
Preparation creates alternatives to payment. Offline, tested backups, a rebuild plan, defined decision-makers, and early legal and regulatory preparation matter before an incident begins.

How Cactus gets into a network

Cactus is not primarily a phishing-led threat that arrives in a mass email campaign. Its operators target the equipment at the edge of a network, which means an attack can begin without an employee opening a malicious attachment.

Vulnerabilities in internet-facing equipment: Operators exploit known weaknesses in network edge devices such as virtual private network (VPN) appliances and in business software exposed to the internet. These systems need to be reachable to provide their services, which makes them persistent targets.
Stolen or purchased credentials: Valid credentials for remote access create a login that can look legitimate and leave little for malware detection to identify.
Social engineering through workplace chat: Reported activity includes operators impersonating internal support through collaboration platforms and persuading targets to grant access. This route bypasses email filtering entirely.

None of these routes depends on a user opening an attachment. Patching exposed systems and requiring strong authentication for remote access therefore matter more against Cactus than awareness training alone, although awareness still helps against chat-based impersonation.

Why Cactus encrypts its own payload

Many ransomware families obfuscate or pack their code to make analysis harder. Cactus delivers its payload in encrypted form and only unpacks it when the operators supply a key during execution. Without that key, the file is inert and its contents are unreadable.

This design limits a category of file-based detection. A security product examining the file, or a sandbox executing it without the correct runtime conditions, may have no meaningful ransomware code to analyze. The operators have also been reported to disable or remove security software on systems they reach, reducing the controls that could otherwise observe the next stage.

Self-encryption does not hide what the process does after it starts. Cactus still has to execute, establish access, disable defenses, scan the network, move laterally, exfiltrate data, and encrypt files across systems. Those actions create behavioral signals. The distinction is central to detection: the payload hides the artifact, while the attack sequence remains visible.

How a Cactus attack unfolds

Reported intrusions follow a recognizable sequence, and most of the operation takes place before any file is encrypted.

Typical stages of a Cactus ransomware attack
Stage	What happens
Initial access	The operators exploit a vulnerability in internet-facing equipment, use stolen credentials, or rely on social engineering to obtain access.
Defense evasion	The encrypted payload is deployed and unpacked with a supplied key. Security and antivirus software on reachable systems may be disabled or removed.
Reconnaissance and lateral movement	The operators scan the network, use scripts and legitimate remote-management tools, and move through Windows systems and virtualization hosts.
Exfiltration	Sensitive data is identified and copied out of the network before encryption, creating the second extortion lever.
Encryption and extortion	Systems are encrypted and a ransom note demands payment for decryption and the deletion of stolen data.

The focus on virtualization infrastructure matters operationally. Encrypting a hypervisor host can affect many systems at once, increasing pressure on the organization more efficiently than encrypting individual machines.

What double extortion means for the response

Double extortion changes the decision an organization faces. With encryption alone, reliable backups can restore operations. When data has already been stolen, restoring systems does not retrieve that data, and the operators can still publish it whether or not recovery succeeds.

A Cactus incident is therefore a data breach as well as an outage. Notification obligations and regulatory exposure may apply independently of whether operations are restored. Paying for a promise to delete stolen data also buys something that cannot be verified. There is no reliable way to confirm deletion, and the data remains in the hands of a criminal group with an incentive to monetize it.

These two consequences should shape the incident plan before an attack. Organizations need to know who makes the payment decision, which legal and regulatory obligations apply, how they will communicate with affected parties, and how quickly critical systems can be rebuilt.

How to defend against Cactus ransomware

Because Cactus usually enters through exposed infrastructure and resists file inspection, effective controls focus on attack surface and behavior:

Patch internet-facing equipment as a priority. Cover edge devices, VPN appliances, and business software reachable from the internet. Exploitation of these systems is a primary route into the environment.
Require phishing-resistant multi-factor authentication for remote access. This closes the stolen-credential route, which otherwise produces a login that can look legitimate.
Inventory and control remote management tools. Alert on the installation or use of remote monitoring and management software that is not sanctioned, since these tools can support lateral movement and blend into legitimate administration.
Detect behavior rather than files. Monitor for security software being disabled, unusual scripting, network scanning from internal hosts, and mass file modification. These signals remain visible even when the payload is unreadable.
Protect virtualization infrastructure specifically. Hypervisor hosts need their own hardening, access controls, and monitoring because compromising one can affect many systems.
Keep offline, tested backups. Backups reachable from the network can be encrypted too. A backup that has never been restored is an assumption rather than a control.
Prepare the response decision before an incident. Define decision-makers, notification obligations, recovery priorities, and the time required to rebuild critical services.

Why the ransom decision is a preparation problem

Strong encryption does not make payment the only viable option. Whether an organization has alternatives is determined long before a ransom note appears, by whether offline backups exist and have been restored from, whether the environment can be rebuilt, and whether decision-makers have worked through the legal and operational consequences in advance. Law enforcement agencies advise against payment, and payment does not guarantee recovery or the deletion of stolen data.

The technical consequence is equally important. Cactus makes its payload unreadable to inspection, so the useful question is not whether a tool recognizes the file. Detection needs to follow the sequence that precedes encryption: exploitation of an exposed device, security tooling being switched off, internal network scanning, unfamiliar remote management software appearing, and data moving outward in volume. Each event occurs before the ransom note and creates an opportunity to intervene.

Sekoia is a European cybersecurity vendor whose AI SOC platform correlates behavior across endpoint, network, identity, and cloud signals and maps detections to the MITRE ATT&CK framework. Cyber threat intelligence from the in-house TDR team adds context about the actors and techniques behind the activity. The important window is the period between initial access and encryption, which can give defenders time to detect and contain the intrusion before the payload runs.

Cactus is designed to survive inspection of its payload. It is far less able to hide a network intrusion that is monitored through behavior across the environment.