Cactus is a ransomware-as-a-service (RaaS) operation that emerged in March 2023, primarily motivated by financial gain through a double extortion model. The group distinguishes itself by encrypting its own binary to evade detection, which it only unpacks when executed. While its exact origin remains unknown, some researchers speculate connections to Russia or a Malaysian hacktivist group. Cactus operators have demonstrated an evolving operational model, with evidence in January 2025 suggesting a potential transition or close affiliation of members from the Black Basta ransomware group, indicating a shared use of tactics, techniques, and procedures.

Paises afectados

URLs nuevas detectadas en IntelTracker