Cactus
Cactus is a ransomware group with a financial motive, tracked by Brandefense. It targets 17 sectors, including Government and Technology, in 26 countries, including the United States and the United Kingdom. It uses 7 MITRE ATT&CK techniques and exploits 3 known CVEs.
- cactus Team
- Techniques
- 7
- Exploited CVEs
- 3
- First seen
- Mar 1, 2023
- Last seen
- Mar 3, 2025
- Record updated
Who They Target.
About Cactus.
The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure. There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox. Source:.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.