Cactus is a ransomware group active since 2023 that breaks into enterprise networks through weak VPN appliances and other remote access systems. It steals data, encrypts systems, and demands payment, a method called double extortion. Its targets are large companies in the United States, the United Kingdom, and parts of Europe. The post reports over 100 publicly confirmed victims by early 2025.
The ransomware ecosystem has changed fast over the last few years. Threat actors have moved to stealthier initial access methods, evasion features and cloud-enabled data exfiltration. In that ecosystem, Cactus has reached a level of technical skill and operational persistence that rivals any ransomware scheme running today. The scheme has been operating since 2023.
Cactus has quickly increased its impact, though not without weak spots. It uses VPN exploitation, covert tunneling techniques and advanced encryption workflows against large companies across the United States, the United Kingdom and parts of Europe.
Introduction: A New Generation of Ransomware Threat Actor
Cactus is a new, highly mobile ransomware actor. It fuses traditional double extortion with new evasion technology. Unlike most of its peers in the ransomware space, Cactus shows a solid grasp of how enterprise networks work in day-to-day use. It can also weaponize vulnerabilities linked with VPNs at scale.
Cactus shows a major trend: ransomware actors no longer rely only on phishing or brute-force entry. They now take advantage of weaknesses in remote access infrastructure, which many companies still struggle to secure. This targeting let Cactus claim more than 100 victims before early 2025.
Who is Cactus and what motivates it?
The Cactus ransomware actor is financially motivated. It ranges from a professional criminal enterprise to a group that is arguably driven toward operational disruption and extortion. Some cybersecurity vendors track Cactus under other names, including GOLD VILLAGE, TA2101, Storm-0216, DEV-0216, UNC2198 TWISTED SPIDER, and Maze Team. These names have all been linked with quite advanced extortion campaigns. In some cases they point to ties or experience with the now historic Maze ransomware.
The Cactus ransomware group focused on:
- Large scale extortion using encryption and data theft
- Operational disruption to increase the ransom pressure
- Monetizing valid and sensitive credential and PII data
This link to actors known for a readiness to inflict damage suggests a legacy operational tie. It may also suggest access to experienced intrusion operatives and aspiration.
- Motivation.
- Financial gain through extortion.
- Active since.
- 2023.
- Targets.
- Large companies in the US, the UK and parts of Europe.
- Main entry route.
- Vulnerabilities in VPN appliances.
- Public victims.
- Over 100 by early 2025.
How does Cactus infiltrate and compromise networks?
A mix of stealth, technical skill and tool variety sets Cactus apart. Its techniques show that it knows its defenders’ blind spots.
Initial Access: Exploiting VPN Weaknesses
Cactus is best known for exploiting VPN appliance vulnerabilities, especially on unpatched, out-of-date firmware.
These include:
- exploitation of remote access (Zero‑days and N-days affecting VPN appliances)
- harvesting credentials from an exposed interface
- password spraying and brute-force attempts on internet-facing systems
This is how Cactus gets around email security layers and gains access directly to the corporate setting.
Persistence: Keeping Long-Term Footholds
The persistence Cactus uses is not as obvious. It involves a registry entry and the use of ntuser.dat, where AES keys are passed and stored. Using the registry this way is atypical. It gives investigators a harder time rebuilding a forensic timeline, and it limits detection by traditional SIEM apps.
Other persistence methods may be:
- scheduled tasks modified or injected after first compromise
- use of remote management tools disguised to look like real software
- abuse of Windows services and registry entries
C2: Stealthy and Redundant Communications
For lateral movement and truly stealthy connections, Cactus relies mostly on Chisel. This is a tunneling tool that offers encrypted connections over standard firewall rules.
C2 architecture:
- HTTPS encrypted communication channels
- Proxying compromised VPN IPs
- Short commands to minimize noise
Malware & Tools: A Simpler Arsenal
Cactus uses a small toolbelt that is sound and well managed. It is designed for stealth and efficiency:
- Custom Cactus ransomware payload with encrypted settings
- Rclone to exfiltrate sensitive data to cloud storage services
- Chisel to tunnel, pivot, and execute lateral movement
- Living-off-the-land binaries (LOLBins), notably PowerShell, PsExec, and WMI
Techniques: Precision and Disruption
The Cactus group consistently employs:
- Double extortion (encrypt + steal)
- Staging encrypted payloads to avoid detection
- Privilege escalation on Windows hosts
- Disruption of backups before deploying ransomware
This approach raises the group’s success rate and the severity of the incident.
- Get inExploit VPN appliance flaws or guess passwordsTechnique T1190 (MITRE ATT&CK, opens in a new tab)
- Stay hiddenRegistry entry and ntuser.dat hold the AES keys
- Move sidewaysChisel tunnel, PsExec, WMI and PowerShell
- Take dataRclone sends files to cloud storageTechnique T1567.002 (MITRE ATT&CK, opens in a new tab)
- Disrupt and encryptBackups are disrupted, then the payload runs
Notable Operations: A Timeline of Expansion
2023 – First Emergence
Cactus was first seen abusing vulnerabilities in VPN appliances. Early attacks hit smaller companies but showed a surprisingly advanced technical footing.
2024 – Large-Scale Enterprise Intrusions
Throughout 2024, Cactus gained ground within corporate networks, mostly targeting mid-sized and large firms. The group also improved its use of Rclone for exfiltration and Chisel for stealthy movement.
2025 – Over 100 Confirmed Victims and Growing
By early 2025, Cactus had claimed over 100 publicly confirmed victims. This is likely a fraction of its actual victim pool, much of which was never disclosed. Its growing infrastructure, more skilled payload encryption and steady focus on VPN-related vulnerabilities were clear signs of growth.
How has Cactus changed recently?
Cactus continues to grow through its campaigns. Some key observations from 2025 are:
- Improved automation features for vulnerability scanning and exploitation
- More intricate workflows developed to pass AES encryption keys
- Expanded geographic targeting (especially Western and Central Europe)
- A much more aggressive approach to disrupting virtualized environments
- Greater use of cloud features for staging and persistence
All of these changes support the group’s expansion. They also suggest that the group is putting major investment into scaling its operations.
Conclusion: Strategic Impact & Defensive Recommendations
Cactus shows the new trend of high-impact ransomware actors that are lean, stealth-oriented and hyper-focused on exploiting remote access vulnerabilities. It can compromise large companies through VPN vulnerabilities. This points to thousands of similar weaknesses in enterprises, at scale.
Defensive Takeaways
Defensive Recommendations. Company exposure to the Cactus group should fall greatly by investing in:
- Ongoing patching of all VPN appliances and all remote access systems
- MFA on all external-facing interfaces that is phishing resistant
- Monitoring endpoints for common tools such as Chisel, Rclone, and eavesdropping via ntuser.dat modification
- Strictly hardening any remote management tools
- Segmenting networks to restrict lateral movement
Cactus is building momentum into 2025. Early defense, together with fast patching and careful monitoring, is key to reducing the risk from yet another increasingly advanced attacker.
You can download and review the sheet for all the details!
