cactus

Víctimas recientes

• T1027 Obfuscated Files or Information — The group uses file obfuscation techniques to avoid detection by defenses.
• T1027.002 Obfuscated Files or Information: Software Packing — Actors use packing in ransomware payload to avoid detection by defenses.
• T1562.001 Disable or Modify Tools — The group uses modification and disabling of security tools to avoid possible malware and access detection.

• T1003.001 OS Credential Dumping — The group performs LSASS memory dump to identify credentials.
• T1555.003 Credentials from Web Browsers — The group searches for key files from users' browsers to locate stored passwords to proceed with the attack and access other accounts.

• T1018 Remote System Discovery — Actors attempt to obtain a list of other systems, hosts, IPs, and any other identifier for lateral movement.
• T1049 System Network Connections Discovery — Actors use tools to scan the organization's infrastructure systems.
• T1087 Account Discovery — Actors attempt to obtain a list of accounts, user names, and valid email addresses for later access.
• T1087.002 Account Discovery: Domain Account — Actors use scripts to identify domain accounts of connected users through Windows event logs.

• T1021.001 Remote Desktop Protocol — Cactus actors use valid accounts to log into devices via RDP.
• T1021.004 Remote Services: SSH — The group uses initial access to set up an SSH tunnel to C2.
• T1570 Lateral Tool Transfer — Actors use tools or other files between systems to prepare files and encrypt data.

• T1567.002 Exfiltration to Cloud Storage — Actors exfiltrate data to a cloud storage service through tools such as Rclone and others.

• T1090 Proxy — Actors use connection proxy to route network traffic between systems to avoid detection by security solutions.
• T1219 Remote Access Software — Actors use RDP connection to access other devices on the internal network.

• T1486 Data Encrypted for Impact — Actors use ransomware payload to encrypt data and change extensions.

• T1538.008 Malvertising — The threat actor was identified by Microsoft as responsible for the Danabot campaign via malvertising for final delivery of Ransomware Cactus.