Cactus

Cactus is a malicious software (malware) that infiltrates systems to exploit and damage them. This malware, often delivered through suspicious downloads, emails, or websites, can steal personal information, disrupt operations, or hold data hostage for ransom. Cactus has been used in several high-profile ransomware attacks, including those on OmniVision, Swedish retail and grocery provider Coop, and Schneider Electric. In 2023, Cactus was responsible for a significant data breach at OmniVision, a leading developer of advanced digital imaging solutions. The company disclosed the breach following the attack, which resulted in severe operational disruptions and potential exposure of sensitive information. The Cactus ransomware attack was part of a series of similar incidents involving different strains of malware, including LockBit, Play, RansomHub, Akira, Hunters, and BlackBasta, each accounting for a share of the overall cyber threats. The Cactus ransomware gang was also involved in other notable attacks. They exploited the DanaBot Trojan in malvertising attacks to spread the Cactus ransomware. In addition, they targeted the Swedish retail and grocery provider Coop, causing significant disruption. The most alarming incident involved Schneider Electric, an energy management and industrial automation firm. The Cactus ransomware gang claimed to have stolen 1.5TB of data from the company, demonstrating the extensive reach and potential damage this malware can inflict.