Cactus Ransomware Profile Guide: How the Group Gets In and How to Stop It

Cactus is a ransomware operation that gets in through internet-facing systems the victim already owns, then hides inside legitimate remote management tools until it encrypts. Kroll first described it in May 2023, reporting activity since at least March 2023 against large commercial organisations, with initial access through vulnerable VPN appliances. Arctic Wolf Labs later documented a campaign that exploited exposed Qlik Sense servers, and in 2025 Trend Micro reported a Cactus intrusion that began with email bombing and fake help desk calls over Microsoft Teams. This profile covers the group's entry routes, the techniques the primary research records, the identity weaknesses it relies on, and the detection and hardening steps that break the chain. It is written for SOC analysts, incident responders and infrastructure owners, and goes deeper than the Ransomware Groups Guide on this one group.

Key takeaways

• The front door is your own edge. Kroll's first cases started with exploited VPN appliances and a VPN service account; Arctic Wolf's started with unpatched Qlik Sense Enterprise for Windows servers.
• Three Qlik CVEs are on the CISA KEV list with known ransomware use. CVE-2023-41266, CVE-2023-41265 and CVE-2023-48365 should be treated as emergency patches on any reachable Qlik Sense server.
• Legitimate tools carry the intrusion. AnyDesk, Splashtop, SuperOps, ManageEngine UEMS, Plink, Chisel and Rclone appear across the reports, often renamed to look like system or vendor files.
• The encryptor protects itself. Kroll found the binary is encrypted and only runs with a key supplied at launch, which frustrates static scanning, so behavioural detection earlier in the chain matters most.
• Help desk social engineering is now part of the playbook. Trend Micro tied a 2025 Cactus case to the same Teams vishing, Quick Assist and BackConnect infrastructure seen in Black Basta intrusions.

Who they are and how the research describes them

Cactus is tracked by its encryptor and extortion brand rather than through a MITRE ATT&CK group entry: as of November 2026 ATT&CK has no group or software page for it, so the technique set below comes from the incident response firms that published primary research. Treat it as a financially motivated, human-operated ransomware operation whose cases show hands-on-keyboard intrusion, data theft and then encryption.

Trend Micro states that since January 2025 it has seen evidence that members of Black Basta moved to Cactus, based on shared tactics, techniques and procedures, and expects Cactus to stay highly active. That makes the Black Basta Threat Actor Profile useful companion reading. Kroll also noted that a PsExec-based deployment script seen in Cactus cases had previously been used with Black Basta. These are overlaps in behaviour and tooling reported by the vendors; this guide does not go further on attribution.

Initial access routes

Edge devices and VPN service accounts

Kroll reports that Cactus actors exploited vulnerable VPN appliances and then used a VPN service account. Its report does not name the products. The defensive lesson is the pairing: a known flaw on a remote access device (ATT&CK T1190 Exploit Public-Facing Application) followed by abuse of a non-human account with network reach (T1078 Valid Accounts, T1133 External Remote Services). Service accounts on VPN concentrators rarely have MFA, rarely have an owner who watches their logins, and often keep the same password for years.

• Patch window: treat VPN and firewall advisories as emergency changes. See the VPN Security Guide.
• Service accounts: inventory every account that can authenticate to the VPN, remove interactive VPN rights from service accounts that do not need them, and alert on any service account session from a new source address.
• Logs: forward VPN authentication and configuration logs off the appliance so they survive tampering. See the VPN and Firewall Log Detection Guide.

Exposed Qlik Sense servers

Arctic Wolf observed Cactus actors exploiting publicly exposed Qlik Sense installations, the first case it knew of in which the group used Qlik Sense for initial access. Qlik's August 2023 bulletin describes CVE-2023-41266 as a path traversal flaw rated 8.2 that lets an unauthenticated attacker create an anonymous session, and CVE-2023-41265 as an HTTP tunnelling flaw rated 9.6 that allows privilege escalation; combined, Qlik says they could lead to unauthenticated remote code execution. Qlik's September 2023 bulletin states that CVE-2023-48365 resolves an incomplete fix for CVE-2023-41265.

Because CVE-2023-48365 completes the earlier fix, a server patched only for the August 2023 bulletin can still be exposed. Check the exact build against Qlik's later bulletin, not just the first one. The Qlik Sense Security guide covers wider hardening, and the CISA KEV Catalogue Guide explains how to drive patch priority from KEV.

Help desk impersonation over Microsoft Teams

Trend Micro's 2025 case followed a pattern it attributes to Black Basta: flood a user's inbox, contact them on Microsoft Teams as IT support, and persuade them to start a Windows Quick Assist session. Some victims were also talked through MFA prompts with QR codes. Malware was then fetched from commercial cloud storage, assembled from .bpx parts, and loaded by side-loading a malicious winhttp.dll into the legitimate OneDrive standalone updater. Trend Micro detects the resulting backdoor as QBACKCONNECT and notes artefacts linking it to QakBot; see the QakBot Malware Guide. Defences are covered in depth in the Email Bombing and Help Desk Impersonation over Teams Guide.

Tactics and techniques (MITRE ATT&CK)

The table maps behaviour described in the Kroll, Arctic Wolf and Trend Micro reports to ATT&CK v20 techniques. Kroll's 2023 report used T1562.001 for security tool tampering; in ATT&CK v20 that behaviour sits under T1685 Disable or Modify Tools, which is used here.

Individual technique guides go further on detection: see MITRE ATT&CK T1219 Remote Access Tools and MITRE ATT&CK T1197 BITS Jobs.

How Cactus abuses identities and credentials

Every documented Cactus entry route turns on an identity the victim did not watch closely enough.

• VPN service accounts: Kroll's initial access chain used one. These non-human accounts are often excluded from MFA and conditional access because they support automation, which makes them ideal for an attacker who has already reached the appliance.
• Local administrator accounts: creating new local admins (Kroll) and resetting the existing local administrator password (Arctic Wolf) gives persistence that survives domain password resets. Unique, rotated local admin passwords and alerts on local group changes close this off.
• Service identities on application servers: on Qlik Sense the attacker's commands ran as children of the Qlik Scheduler service, so they inherited whatever that service account could reach. A tightly scoped service account limits the blast radius of the next application flaw.
• Browser-stored credentials: Kroll lists T1555.003 and recommends password managers instead of browser storage, particularly for administrators.
• Help desk trust: the 2025 route bypassed technical controls entirely by persuading a user to hand over a remote session and approve MFA prompts.
• ESXi root: Trend Micro saw SSH used as root on ESXi hosts to change security settings and turn off the host firewall, so hypervisor administration credentials need the same protection as domain admin.

For recovering identity systems after an intrusion like this, see Recovering IAM and PAM After Ransomware or Domain Compromise.

Detection and defence

Cactus encryptors resist static scanning, so the reliable detection points are earlier: the exploited application behaving oddly, remote tools appearing, accounts changing and data leaving. The table lists signals drawn from the primary reports and where to collect them.

Hardening priorities

1. Close the known entry points: patch Qlik Sense to a build fixed for CVE-2023-48365, remove Qlik Sense and other business applications from direct internet exposure, and keep VPN appliances current. Kroll's first recommendation is to patch VPN devices.
2. Lock down remote access tools: keep an approved list of remote management products, block the rest with application control and egress filtering, and restrict Quick Assist to devices and users that need it. Trend Micro recommends requiring approval or verification for remote help sessions. See Detecting RustDesk, MeshCentral and Tactical RMM Abuse for the wider RMM problem.
3. Restrict Teams external access: limit external federation to known partner domains and monitor external chats with the same rigour as email, as Trend Micro advises.
4. Harden identities: MFA on all remote access including service accounts where technically possible, least privilege for application service accounts, unique local admin passwords, and password managers for administrators, all of which appear in Kroll's recommendations.
5. Protect hypervisors: keep ESXi management off user networks, disable SSH unless in use, and alert on configuration changes. See the ESXi Ransomware Playbook.
6. Make recovery independent: Kroll advises multiple backups with at least one isolated from the network. See the Backup Security and Immutable Backup Guide.

Responding to a suspected Cactus intrusion

1. Contain the entry point: isolate the exploited Qlik Sense server or VPN appliance and disable the abused service account, preserving logs and a disk image first where possible.
2. Hunt for the tool set: sweep the estate for remote management tools, Chisel, Plink and Rclone, including renamed copies, and for scheduled tasks that launch SSH or unknown binaries.
3. Reset identities in order: local administrator accounts, service accounts, then privileged domain accounts, and revoke remote tool enrolments.
4. Scope exfiltration: review egress logs for transfers to cloud storage in the days before discovery; see the Data Exfiltration Scoping Guide.
5. Restore from clean, isolated backups only after the entry route is closed, then retest the hardening steps above.

Metrics that show the controls are working

• KEV exposure: number of internet-reachable assets with an unpatched KEV entry, target zero, and median days to patch KEV items on edge devices.
• Unapproved remote tools: endpoints running remote management software outside the approved list, trending to zero.
• Service account coverage: percentage of VPN-capable service accounts with an owner, MFA or source restriction, and login alerting.
• Logging coverage: percentage of servers sending process creation with command line and PowerShell script block logs to the SIEM.
• Detection drill time: time from a simulated renamed remote tool or Scheduler child process to analyst triage.

Framework mapping

Common failure patterns

• Patching only the first Qlik bulletin. CVE-2023-48365 exists because the first fix for CVE-2023-41265 was incomplete, so servers updated in August 2023 and never again can remain exploitable.
• Treating business intelligence servers as internal tools. Analytics platforms are often published to the internet for partners or remote staff and left outside the edge patching process.
• Allowing any remote support product. If AnyDesk or a second RMM tool is normal in the estate, a renamed copy blends in. An approved list makes every other remote tool an alert.
• Service accounts exempt from everything. A VPN service account with no MFA, no source restriction and no login monitoring turns one exploited appliance into a long-lived foothold; the Colonial Pipeline Ransomware Attack 2021 showed how far a single unmonitored VPN account without MFA can reach.
• Relying on signature scanning of the payload. Kroll found the encryptor only runs with a key supplied at launch; defenders who wait for the encryptor to be caught have missed the earlier signals.
• Help desk processes that cannot be verified. When users cannot easily tell a real IT contact from a fake one on Teams, a phone call or chat is enough to hand over a session.

Practitioner checklist

• Confirm every Qlik Sense Enterprise for Windows server runs a build fixed for CVE-2023-48365, and remove direct internet exposure.
• Track CVE-2023-41266, CVE-2023-41265 and CVE-2023-48365 through your KEV patch process and report any exception.
• Inventory VPN-capable service accounts, assign owners, restrict source addresses and alert on new-location logins.
• Publish an approved remote management tool list and block or alert on everything else, including renamed binaries.
• Restrict Quick Assist and Teams external access, and give users a simple way to verify IT contacts.
• Enable process creation with command line and PowerShell script block logging on all servers and forward them to the SIEM.
• Alert on Qlik Scheduler child processes, local administrator changes and security agent uninstalls.
• Disable SSH on ESXi when not in use and forward ESXi logs.
• Keep at least one backup copy isolated from the network and test restores.

Standards and references

• Kroll: CACTUS Ransomware, Prickly New Variant Evades Detection
• Arctic Wolf Labs: Qlik Sense Exploited in Cactus Ransomware Campaign
• Trend Micro: Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal
• Qlik: Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-41266, CVE-2023-41265)
• Qlik: Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-48365)
• CISA: Known Exploited Vulnerabilities Catalog
• MITRE: ATT&CK Enterprise Matrix

Related NHI Mgmt Group resources: Ransomware Groups Guide · Black Basta Threat Actor Profile · QakBot Malware Guide · Qlik Sense Security · Email Bombing and Help Desk Impersonation over Teams Guide