Cactus

Cactus is a type of malware, specifically ransomware, known for its malicious activities including data theft and system disruption. This malware has been linked to several high-profile attacks, spreading primarily through malvertising campaigns that leverage the DanaBot Trojan. Notably, the Cactus ransomware gang claimed responsibility for a massive data breach at Schneider Electric, an energy management and industrial automation firm, alleging the theft of 1.5TB of data. The group also targeted the Swedish retail and grocery provider Coop, causing significant disruptions. In 2023, OmniVision, a leading developer of advanced digital imaging solutions, disclosed a data breach following a Cactus ransomware attack. The incident was one among many that contributed to Cactus' reputation as a major cybersecurity threat. In another significant event, the Housing Authority of the City of Los Angeles (HACLA) fell victim to a Cactus ransomware attack, with the cybercriminals claiming to have stolen 861GB of data, including personal, financial, and backup information. Despite its destructive capabilities, Cactus was not the most prevalent ransomware in circulation. It came in second place, accounting for 7.74% of ransomware incidents, trailing behind LockBit but ahead of RansomHub, Play, Akira, Hunters, and BlackBasta. These figures underscore the persistent and diverse nature of the ransomware threat landscape, with Cactus representing a significant part of this ongoing challenge.