The document describes Cactus ransomware, noting that it sets itself apart through distinctive encryption methods that make it difficult to detect. It exploits VPN vulnerabilities to infiltrate networks rather than relying on phishing emails, and has the ability to self-encrypt to remain undetected on compromised systems. The document outlines the 8-step attack process Cactus ransomware uses, which involves gaining initial access through a VPN appliance weakness, installing the ransomware, mapping the network, deploying tools to facilitate movement, installing remote monitoring software, exfiltrating data, disabling antivirus, and distributing the ransomware across all systems.

1. @infosectrain
#
l
e
a
r
n
t
o
r
i
s
e
HACKER’S HEIST
CACTUS
0
1
1
0
1
0
0
0
0
1
1
1
1
0
1
1
0
1
1
1
1
0
1
0
1
1
0
1
0
0
1
0
0
1
1
0
1
1
0
1
0
1
1
0
1
0
1
1
0
1
0
0
1
1
0
0
1
0
0
0
1
1
0
1
0
0
0
0
1
1
1
1
0
1
1
0
1
1
1
1
0
1
0
1
1
0
1
0
0
1
0
0
1
1
0
1
1
0
1
0
1
1
0
1
0
1
1
0
1
0
0
1
1
0
0
1
0
0
0
1
1
0
1
0
0
0
0
1
1
1
1
0
1
1
0
1
1
1
1
0
1
0
1
1
0
1
0
0
1
0
0
1
1
0
1
1
0
1
0
1
1
0
1
0
1
1
0
1
0
0
1
1
0
0
1
0
0
0
1
1
0
1
0
0
0
0
1
1
1
1
0
1
1
0
1
1
1
1
0
1
0
1
1
0
1
0
0
1
0
0
1
1
0
1
1
0
1
0
1
1
0
1
0
1
1
0
1
0
0
1
1
0
0
1
0
0
0101 11 111011 0 1 101 0 111
0001 00 111 010 00 101 0 101
0101 11 111011 0 1 101 0 111
0001 00 111 010 00 101 0 101
0101 11 111011 0 1 101 0 111
0001 00 111 010 00 101 0 101
PAY FOR
UNLOCK
*********
RANSOMWARE

2. WHAT IS
CACTUS
Cactus Ransomware sets itself
apart with its distinctive encryption
methods, making it difficult to detect
by security tools. It exploits VPN
vulnerabilities to infiltrate networks
instead of relying on phishing emails,
and it possesses the uncommon
ability to self-encrypt, enhancing
its chances of remaining
undetected on compromised
systems.
www.infosectrain.com
@infosectrain
#
l
e
a
r
n
t
o
r
i
s
e
RANSOMWARE
Lorem ipsum dolor sit amet, consectetur
adipiscing elit, sed diam nonummy
LOREM IPSUM

3. The attacker gets into the victim's
network using a weakness in a
VPN appliance. They do this by
taking advantage of known
vulnerabilities in VPN appliances
that haven't been fixed
or updated.
www.infosectrain.com
@infosectrain
#
l
e
a
r
n
t
o
r
i
s
e
CACTUS
Attack Tactics Techniques
& Procedures
RANSOMWARE
STEP 1
CONNECT
VPN

4. The attacker installs the Cactus
ransomware on the victim's system.
This can be done through various
methods, such as phishing emails,
malicious attachments, or drive
by downloads.
www.infosectrain.com
@infosectrain
#
l
e
a
r
n
t
o
r
i
s
e
The attacker conducts an internal
network scan using tools like
SoftPerfect Network Scanner or
PSnmap to create a map of the
environment.
STEP 3
STEP 2
!
* * * * * * * * *
* * * * * * * * *

5. To facilitate lateral movement, the
attacker deploys the CobaltStrike
post-exploitation framework
and Chisel proxying tool.
www.infosectrain.com
@infosectrain
#
l
e
a
r
n
t
o
r
i
s
e
The attacker installs Remote
Monitoring and Management
(RMM) tools on compromised systems,
enabling remote access and file
pushing capabilities.
STEP 5
STEP 4

6. The attacker employs the Rclone
tool to conduct data theft from
the environment, automating the
process for data exfiltration.
www.infosectrain.com
@infosectrain
#
l
e
a
r
n
t
o
r
i
s
e
STEP 7
The attacker executes a script
to disable widely used anti-virus
tools to decrease the chances
of their tools being detected
and blocked.
STEP 6

7. www.infosectrain.com
@infosectrain
#
l
e
a
r
n
t
o
r
i
s
e
The attacker utilizes a PowerShell
script to distribute ransomware
across all systems within the
environment.
STEP 8

8. www.infosectrain.com
@infosectrain
#
l
e
a
r
n
t
o
r
i
s
e
TIPS TO PROTECT YOURSELF FROM
CACTUS
Keeping VPN appliances up to
date with the latest security patches.
RANSOMWARE
01
Using network monitoring tools to
detect suspicious activity.
02
Educating yourself about ransomware
attacks.
03
Implementing strong password policies
and enforcing multi-factor authentication.
04

9. FOUND THIS USEFUL?
Get More Insights Through Our FREE
Courses | Workshops | eBooks | Checklists | Mock Tests
LIKE SHARE FOLLOW