The primary goal for Cactus is simple: financial gain. They achieve this through a double-extortion model. First, they encrypt your critical data, bringing business operations to a grinding halt. Then, they threaten to leak the sensitive information they stole before encryption, adding public humiliation and regulatory fines to your list of problems.

Cactus gets its foot in the door by exploiting known vulnerabilities in public-facing applications, particularly VPN appliances (like Fortinet and Qlik Sense) and other remote access services. Once inside, they use "Living-off-the-Land" (LotL) tactics, abusing legitimate tools like PowerShell, Rclone, and remote management software (AnyDesk, Splashtop) to blend in with normal network traffic and evade detection.

The Cactus attack chain is a well-oiled machine.

• Initial Access: They gain entry by exploiting unpatched VPNs, conducting phishing campaigns, or buying stolen credentials from dark web forums.

• Persistence & Discovery: They create an SSH backdoor and use scheduled tasks to maintain access. They then scan the network using tools like SoftPerfect Network Scanner to map out the environment and find more targets.

• Credential Access: The group dumps credentials from LSASS and web browsers to escalate privileges and move laterally.

• Defense Evasion: Here’s their signature move. Cactus encrypts its own ransomware binary to avoid being flagged by antivirus solutions. They also use scripts to uninstall common security tools.

• Exfiltration & Impact: Before deploying the ransomware, they steal data using tools like Rclone. Finally, a PowerShell script automates the encryption process across the network, leaving behind their ransom note, "cAcTuS.readme.txt."