Cactus ransomware

Cactus is a human-operated, double-extortion ransomware family seen since March 2023. Encrypted files gain a .cts suffix plus a digit that reflects the processing stage: .cts0 marks a file still being prepared, .cts1 a finished one, and higher digits appear when the locker is run more than once over the same data. Each affected folder receives a note called cAcTuS.readme.txt, written in deliberately mixed case, which names the group, warns that stolen data will be leaked and gives an email address, a Tox ID and a per-victim reference. The operators go after large companies, typically entering through unpatched VPN appliances and, in later campaigns, exposed Qlik Sense servers, then using remote-management tools for persistence and Rclone to copy data to cloud storage before encryption. The Windows payload ships encrypted and only unpacks when launched with a key passed on the command line, which hinders analysis and detection. Cactus intrusions have overlapped with the BackConnect malware used in Black Basta campaigns, but Cactus is tracked as its own operation with its own encryptor.

File extensions: .cts0, .cts1

Ransom note filenames: cAcTuS.readme.txt

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-28.

Data exfiltration risk: Confirmed — Incident responders documented Rclone uploads of victim data to cloud storage before encryption, and the note threatens publication; the group runs a leak site.

Systems typically targeted: Windows servers and workstations in corporate networks

Do this first: Patch or isolate internet-facing VPN appliances and Qlik Sense servers, then hunt for Rclone, remote-management tools and files ending in .cts0 or .cts1 before restoring anything.