Threat Intelligence Report March 4 - March 10 2025

Cactus Ransomware Group

Overview

The Cactus ransomware group has been observed utilising a multi-stage attack chain combining social engineering, lateral movement, ESXi hypervisor exploitation, and custom backconnect C2 implants. Red Piranha’s detection and incident response efforts uncovered evolutionary changes in Cactus’ tactics, techniques, and procedures (TTPs), emphasising a shift toward stealthier and more sophisticated lateral movement and persistence mechanisms. Although encryption was prevented in this case, attackers exhibited full kill chain completion readiness, including network traversal, privilege escalation, and ransomware delivery staging.

Detailed TTPs

Initial Access (TA0001)

• Phishing & Social Engineering (T1566):
  • Email bombing campaigns targeting victim inboxes.
  • Microsoft Teams impersonation from [email protected], luring victims to accept Quick Assist remote sessions.

Execution (TA0002)

• User Execution (T1204):
  • Victim manipulated to download and extract malicious archives:
    • .bpx files concatenated into pack.zip, containing malicious DLLs and executables masquerading as legitimate OneDrive files.

Persistence (TA0003)

• Registry Modification (T1112):
  • Registry key HKCU\SOFTWARE\TitanPlus added to store BackConnect C2 IP addresses.

Privilege Escalation (TA0004)

• DLL Sideloading (T1574.002):
  • Placement of custom DLLs (e.g., wscapi.dll, libssl-3-x64.dll) in a trusted OneDrive directory for execution via OneDriveStandaloneUpdater.exe.

Defence Evasion (TA0005)

• Masquerading (T1036):
  • Use of OneDrive file names and directories to evade detection.
• Disabling Security Tools (T1562):
  • On ESXi, disabled ExecInstalledOnly and firewall to run unauthorised binaries.

Credential Access (TA0006)

• Potential use of WinRM and SMB to harvest and reuse administrative credentials during lateral movement.

Lateral Movement (TA0008)

• SMB (T1021.002) and WinRM (T1021.006):
  • Network traversal using file shares and remote code execution via WinRM.

Command-and-Control (TA0011)

• BackConnect Implants (T1573):
  • Dynamic C2 registration via registry keys.
• WinSCP Deployment (T1105):
  • File transfer and exfiltration using WinSCP connecting to pumpkinrab.com.

Impact (TA0040)

• Ransomware Deployment (T1486):
  • Encryption attempt was interrupted, but ransom note delivered via email identifying as "Cactus Group

Tactic	Technique	Description
Initial Access	Phishing & Social Engineering (T1566.003)	Email bombing and Teams social engineering to gain access.
	Trusted Relationship Abuse (T1199)	Abuse of Teams for impersonation and remote access.
Execution	Malicious File Execution (T1204.002)	Download and execution of malicious .bpx archive files.
	Command Line (T1059.003)	Likely used for file manipulation and extraction.
Persistence	Registry Modification (T1547.001)	Registry key added for C2 communication (TitanPlus).
Privilege Escalation	DLL Sideloading (T1574.001)	Malicious DLLs loaded via OneDriveUpdater.exe.
Defence Evasion	Masquerading (T1036.005)	Files hidden in trusted OneDrive folders.
	Disable Firewall/Protections (T1562.004)	Disabled ESXi firewall and security settings.
Lateral Movement	SMB (T1021.002) and WinRM (T1021.006)	Spread through the network using shares and remote execution.
Command-and-Control (C2)	BackConnect C2 (T1071.001, T1571)	Communication with custom C2 via registry and HTTPS.
	WinSCP File Transfer (T1105)	WinSCP used for moving files and exfiltration.
Impact	Data Encryption (Planned) (T1486)	Ransomware prepared but stopped before execution.

Indicators of Compromise (IOCs)

Downloaded Files:

Extracted payloads (OneDrive masquerade):

Registry Key:
HKCU\SOFTWARE\TitanPlus

Communication:

TOX: 7367B422CD7498D5F2AAF33F58F67A332F8520CF0279A5FBB4611E0121AE421AE1D49ACEABB2

SONAR:
http://sonarmsng5vzwqezlvtu2iiwwdn3dxkhotftikhowpfjuzg7p3ca5eid.onion/contact/Cactus_Support

URLs

File Server:

https://vhfd5qagh6j7qbisjqvly7eejqbv6z5bv77v6yuhctn77wmd3hjkyvad.onion
https://acfckf3l6l7v2tsnedfx222a4og63zt6dmvheqbvsd72hkhaqadrrsad.onion
https://6wuivqgrv2g7brcwhjw5co3vligiqowpumzkcyebku7i2busrvlxnzid.onion
https://truysrv2txxvobngtlssbgqs3e3ekd53zl6zoxbotajyvmslp5rdxgid.onion
https://jvtxo5gdcgloguty322ynfnpqkc2whe2jauc7ucm7bzmgct3k7ogr4yd.onion/

Mitigations

Initial Access Mitigation

• Implement phishing-resistant MFA (e.g., hardware tokens, FIDO2).
• Security awareness training on Quick Assist abuse and Microsoft Teams impersonation.
• Harden external communications; restrict Teams communications from external tenants.

Execution and Persistence Mitigation

• Block unsigned DLL loading via Windows Defender Application Control (WDAC).
• Monitor for unusual files in OneDrive directories and .bpx/.cab file downloads.
• Use group policy to disable Quick Assist if not required.
   

Lateral Movement Mitigation

• Restrict WinRM and SMB access using firewall rules and segmentation.
• Enforce LSA Protection to prevent credential theft.
• Monitor WinRM logs (Event ID 4688, 7045) and SMB share creation.

Ransomware Victims Worldwide

A recent ransomware analysis reveals that the United States remains the most heavily impacted nation, accounting for a staggering 61.27% of global incidents, highlighting its continued vulnerability to ransomware threats. Following this, Canada reported 5.63% of the attacks, emerging as another highly targeted region.

Brazil, India, and the United Kingdom also faced considerable exposure, each reporting 3.52% of ransomware incidents. Italy and Australia experienced 2.82% of attacks, indicating an ongoing risk in these regions. Spain, Japan, Germany, Switzerland, and France recorded 1.41% of global ransomware cases, reflecting notable, though comparatively lower, targeting.

Several other nations exhibited moderate levels of ransomware incidents, including Botswana, Argentina, Nigeria, Singapore, Malta, Indonesia, Austria, Portugal, Denmark, Turkey, Ukraine, Norway, Malaysia, South Africa, and Sweden, each reporting 0.7% of global ransomware cases.

This analysis underscores the persistent and widespread nature of ransomware attacks, with North America facing particularly high levels of risk. These findings highlight the critical need for robust cybersecurity measures, proactive defence strategies, and heightened vigilance across all sectors to counteract the increasing ransomware threat worldwide.