An infection with Cactus is characterised by your systems displaying a notice like the one shown here with a specialist cyber crime group holding your infected systems and stolen data hostage until you pay a ransom.
If you discover a physical break-in at your offices, your first instinct would be to call the police; touch nothing and let them search for clues. A cyber-attack requires the same approach.
Your digital environment is a CRIME SCENE. It is crucial to leave the environment untouched to allow for a forensic investigation. This is not a task for your IT team or MSP. Digital Forensic specialists available 24/7 to assist you, just like in a physical crime.
If you discover a message on your system, similar to the one above - you've likely been ransomed by Cactus.
Cactus is a Ransomware-as-a-Service (RaaS) operator that was first observed in March 2023. The TotalExec.ps1 script used by Cactus was previously used by the BlackBasta group in 2022 which suggests Cactus has origins in Russia. During its 12 months in operation, it has attacked several large commercial businesses across the globe, from the US and Italy to the United Kingdom, Switzerland, and France.
Demonstrating advanced evasion tactics, Cactus has shown proficiency in gaining initial access to networks by exploiting known vulnerabilities in Virtual Private Network (VPN) appliances, allowing the group to establish a foothold within compromised infrastructures. The group has also been observed conducting phishing attacks and buying stolen credentials from affiliates. Like many ransomware groups, Cactus adopts double-extortion tactics - stealing data from target networks and then encrypting it on compromised systems.
Double extortion is a nefarious tactic used by cybercriminals, to amplify the impact and urgency of their demands. In a double extortion scheme, the perpetrators not only encrypt the data but also threaten to release or sell it if their ransom demands are not met.
This dual-threat strategy significantly increases the pressure on the victim organisation to comply with the ransom demands.
Cactus emerged in 2023 but as stated above, the script used by the group was previously used by the BlackBasta group in 2022 which suggests Cactus is the reincarnation of an early group / made up of disbanded group members, making the exact founding date of Cactus hard to pinpoint.
To date, Cactus has compromised 248 organisations.
Solace Cyber’s track record includes hundreds of successful response recoveries, providing Digital Forensic Incident Response services, 24x7x365.
"Over the past five years, cyberattacks have cost British businesses approximately £44 billion in lost revenue, with 52% of private sector companies experiencing at least one attack during that period."
Read more...
When a cyber incident occurs, take these immediate actions:
Solace Cyber acts as your specialist digital forensics partner in Australia, helping restore normal operations swiftly. Our response includes:
Recovery timelines typically range from 2 weeks to 2 months, depending on the incident's scope.
Solace Cyber delivers global risk and security services across Australia, specialising in travel, crisis support, and offshore risk management. The organisation runs a fully staffed security operations centre around the clock and maintains an internal intelligence unit that produces routine daily and weekly updates. The business is certified to ISO 27001, ISO 14001, ISO 45001, and ISO 9001 standards.
Founded in the UK in 2021, Solace Cyber has grown its presence throughout Australia, concentrating on cyber incident handling, including digital forensics, incident response, ransomware events, information security, and wider risk management, supported by managed security services. The senior leadership team has more than two decades of combined experience across security and IT.
s
%+
A forensic analysis needs to be meticulous and a clean restore and recovery requires a wealth of experience not normally available in an in-house team who must provide a broader range of IT support skills:
Solace Cyber was established precisely for this scenario. We have a well-defined process for handling cyber-attacks like Cactus, which involves a 6-step approach:
It includes a thorough digital forensic analysis from step 2 where the output becomes a central component of business recovery. This is because understanding the attack is of critical importance:
It is critical that the analysis of digital evidence is carried out to an agreed plan. This will have been designed to provide the best and earliest chance of discovering a root cause, which is essential to inform remediation/eradication and recovery as well as supporting a legal take-down case if this is applicable. A legal take-down means we can assist in the legal enforcement that stops the criminals from publishing the data, thus undermining the ransom notice.
Solace’s Digital Forensic and Incident Response teams maintain consistent communication throughout. Dedicated Incident Managers and technical engineering leads provide updates during the Cyber Incident Response journey, utilising risk registers and working within change management processes, all from triage through to post-incident, delivering successful business recovery.
Solace Cyber's assistance extends beyond the recovery phase. Following the restoration of your business operations, we collaborate with you to enhance your cyber security posture using a threat-informed methodology. This involves leveraging our Cyber 9 Step Process, designed to comprehensively address cyber threats and vulnerabilities.
The Cactus ransomware entered your system by one of several ways:
We recommend you adopt policies to:
After recovering from a Cactus ransom attack, Solace Cyber recommends that you update your business continuity plan to account for lessons learnt during this attack & recovery.
Most ransomware breaches cost approximately £500K, while smaller email data breaches typically cost around £50K. There is a critical balance between preserving the environment for forensic analysis and quickly recovering it to minimise business interruption. The costs increase the longer it takes to identify and resolve the breach.
A cyber security insurance claim is complex, covering reasonable expenses for investigating and remediating an incident, along with legal fees, business interruption, criminal liability, employment liability, and ransom payments. Although the insurance industry is responsible for facilitating business recovery, cyber insurance is viewed as volatile, and many policies are not being validated correctly.
Finding your way through demands expertise, and that's where Solace Cyber can offer assistance.
Criminal organisations like Cactus are paid by affiliates to launch cyber-attacks using their specific brand of malware that is known for its swift and efficient encryption capabilities. Even if the ransom is paid, the likelihood of having files decrypted and data restored is minimal, underscoring the necessity of employing a ransomware incident response team.
The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home
Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.
The latest iteration can be found here: https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets
Yes. There's a possibility that some of the lost data falls under the category of "Personal Data" belonging to your customers. It's your legal responsibility to safeguard this data, even if it has been lost. Additionally, you may need to notify the Information Commissioner's Office at https://ico.org.uk/.
Your insurer or legal counsel will provide guidance on the necessary steps and how to move forward in this situation.
Solace has experience collaborating with insurers and legal professionals and can offer support in managing this relationship during this challenging period.
A ransomware attack presents the most significant threat to your business by:
In the event of a business interruption, determining your position in the supply chain for any item and sustaining operations become challenges. If the disruption persists, maintaining business continuity becomes paramount. Moreover, upon restoration of systems and data, addressing any backlog of work and establishing operational protocols for the future becomes essential.
Ransomware ranks only behind receivership in terms of its capacity to incapacitate a business.
Action Fraud is the UK’s national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Action Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.
In the event of a Cactus ransom attack on your systems, REMAIN CALM.
DO NOT INTERACT WITH THEM, ATTEMPT TO RESTORE, OR OVERWRITE ANY DATA (explanation above).
Reach out to Solace Cyber at +61 (0) 282 786100 or complete our form for a callback from one of our specialists.
We'll respond promptly to minimise your business's downtime.
Solace Cyber helps companies across Australia recover from ransomware attacks and data breaches.
Ransomware Recovery
Ransomware Groups
BEC Recovery
About Us
Blog
News
SOLACE CYBER LTD is registered in England & Wales no. 08830710
Solace Cyber
Zensec Ltd,
60 Martin Place,
Sydney,
NSW 2000
Telephone
Please note that calls may be recorded for security and training purposes.
