Skip to main content
Darkfield

Operator dossier

Cactus is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 552 public victims claimed by this operator between July 20, 2023 and March 21, 2025. **Overview:** Cactus is a ransomware group that emerged in July 2023, primarily motivated by financial gain through double extortion tactics targeting organizations across multiple sectors. The group has demonstrated rapid expansion, compromising 552 known victims within its first year of operation. **Origin & Affiliation:** Limited public information exists regarding Cactus's country of origin or specific affiliations with other ransomware groups, though their targeting patterns and operational methods suggest they operate as an independent entity rather than a Ransomware-as-a-Service model. **Attack Methodology:** Cactus ransomware operators employ double extortion tactics, stealing sensitive data before encrypting victim systems and threatening to leak the information if ransom demands are not met. The group appears to focus on gaining initial access through common vectors such as compromised credentials and vulnerable internet-facing applications, followed by lateral movement and data exfiltration prior to deployment of their encryption payload. **Notable Campaigns:** While specific high-profile incidents have not been extensively documented by major security agencies, the group's victim count of 552 organizations within approximately one year indicates sustained and aggressive targeting campaigns across North America and Europe. Their focus on manufacturing and business services sectors suggests deliberate targeting of organizations likely to pay ransoms due to operational dependencies. **Current Status:** Cactus remains an active ransomware threat as of late 2024, continuing to target organizations primarily in the United States, Canada, and European countries with no reported law enforcement disruptions or confirmed dissolution of their operations.

Most-targeted sectors

Most-affected countries

Recent disclosures by Cactus

Most recent 150 of 552 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Cactus →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Cactus

552 victims indexed · first seen 3 years ago · last activity 1 year ago

552
Victims indexed
#20 of 364 tracked operators
1y 8m
Active period
Jul 2023 → Mar 2025
10
Countries hit
top United States · 103

At a glance

Status
inactive
First seen
3 years ago
Last activity
1 year ago
Onion sites
2 known endpoints
Primary sector
Manufacturing · 34 hits

About

**Overview:** Cactus is a ransomware group that emerged in July 2023, primarily motivated by financial gain through double extortion tactics targeting organizations across multiple sectors. The group has demonstrated rapid expansion, compromising 552 known victims within its first year of operation. **Origin & Affiliation:** Limited public information exists regarding Cactus's country of origin or specific affiliations with other ransomware groups, though their targeting patterns and operational methods suggest they operate as an independent entity rather than a Ransomware-as-a-Service model. **Attack Methodology:** Cactus ransomware operators employ double extortion tactics, stealing sensitive data before encrypting victim systems and threatening to leak the information if ransom demands are not met. The group appears to focus on gaining initial access through common vectors such as compromised credentials and vulnerable internet-facing applications, followed by lateral movement and data exfiltration prior to deployment of their encryption payload. **Notable Campaigns:** While specific high-profile incidents have not been extensively documented by major security agencies, the group's victim count of 552 organizations within approximately one year indicates sustained and aggressive targeting campaigns across North America and Europe. Their focus on manufacturing and business services sectors suggests deliberate targeting of organizations likely to pay ransoms due to operational dependencies. **Current Status:** Cactus remains an active ransomware threat as of late 2024, continuing to target organizations primarily in the United States, Canada, and European countries with no reported law enforcement disruptions or confirmed dissolution of their operations.

References

10 links

External sources curated by the MISP threat-intel community.

Timeline

20 months
2023-07-01T00:00:00+00:00 · 182023-09-01T00:00:00+00:00 · 332023-10-01T00:00:00+00:00 · 52023-11-01T00:00:00+00:00 · 102023-12-01T00:00:00+00:00 · 582024-01-01T00:00:00+00:00 · 202024-02-01T00:00:00+00:00 · 202024-03-01T00:00:00+00:00 · 302024-04-01T00:00:00+00:00 · 322024-05-01T00:00:00+00:00 · 192024-06-01T00:00:00+00:00 · 402024-07-01T00:00:00+00:00 · 222024-08-01T00:00:00+00:00 · 182024-09-01T00:00:00+00:00 · 362024-10-01T00:00:00+00:00 · 222024-11-01T00:00:00+00:00 · 122024-12-01T00:00:00+00:00 · 102025-01-01T00:00:00+00:00 · 192025-02-01T00:00:00+00:00 · 772025-03-01T00:00:00+00:00 · 51
2023-07-01T00:00:00+00:002025-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
103
🇨🇦 Canada
17
🇬🇧 United Kingdom
15
🇫🇷 France
9
🇮🇹 Italy
7
🇪🇸 Spain
6
🇳🇱 Netherlands
5
🇩🇰 Denmark
4
United States dossier →Canada dossier →United Kingdom dossier →France dossier →

Top sectors

Manufacturing
34
Business Services
33
Technology
29
Agriculture and Food Production
11
Consumer Services
10
Transportation/Logistics
9
Healthcare
7
Financial
4
Manufacturing dossier →Business Services dossier →Technology dossier →Agriculture and Food Production dossier →

MITRE ATT&CK

15 techniques · 10 tactics

Tactics

CollectionCommand And ControlCredential AccessDiscoveryExecutionInitial AccessLateral MovementPersistencePrivilege EscalationStealth

Techniques

Recent victims

Loading…

Onion infrastructure

2 known
  • http://cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion
  • https://cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion

Source

Updated 1 year ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Cactus posts a victim.

Add Cactus to your watchlist — Pro pings you within 5 minutes of any new Cactus leak-site post, Telegram callout, or affiliate-rebrand inference.