CACTUS Hackers Exploiting Bug to Attack Corporate Networks

Threat actors known as CACTUS orchestrated a sophisticated attack on two companies simultaneously, exploiting a software vulnerability within 24 hours of its disclosure.

This coordinated ransomware attack highlighted organizations’ growing risks in the digital landscape.

The attack involved intricate steps, including infiltrating networks, implanting remote access tools, encrypting workstations, and targeting virtualization infrastructure across different servers.

virtualization infrastructure
virtualization infrastructure

Rapid Exploitation of Vulnerabilities

The attack began less than 24 hours after disclosing a critical vulnerability in the Ivanti MobileIron Sentry, identified as CVE-2023-38035, with a CVSS score of 9.8.

This flaw allowed attackers to bypass authentication controls and execute code remotely.

The rapid weaponization of this vulnerability underscores a growing trend among cybercriminals to exploit software bugs swiftly, often before organizations can patch them.

ransomware group had targeted only Windows workloads
ransomware group had targeted only Windows workloads

CACTUS’s operation was not only swift but also meticulously coordinated.

The hackers initially infiltrated one organization’s network before moving on to another company within the same group.

Despite the companies operating independently with separate networks, the attackers managed to exploit the interconnectedness of some machines to launch simultaneous attacks on both entities.

The assault was multifaceted, involving data exfiltration and the encryption of workstations and virtual machines, including domain controllers.

Recently, Bitdefender Labs collaborated in an investigation that unfortunately confirms two significant predictions made for 2024: the swift proliferation of opportunistic ransomware and the growing sophistication of cyber attacks.

Key Points:

  • Rapid Response: CACTUS swiftly capitalized on a Remote Code Execution (RCE) vulnerability, emphasizing the need for organizations to address such threats promptly.
  • Meticulous Coordination: The attack was meticulously planned, with synchronized actions on both companies within a five-minute window
  • Expanded Target Scope: CACTUS expanded its targets beyond Windows workloads to include ESXi and Hyper-V hosts, showcasing a broader focus
  • Forensic Expertise: The affected companies sought forensic expertise from Bitdefender Labs instead of paying the ransom, demonstrating a proactive approach to handling cyber threats

Expanding Targets and Sophisticated Tactics

Traditionally focusing on Windows workloads, CACTUS has expanded its scope to include ESXi and Hyper-V hosts, indicating a broader targeting strategy.

The group employed various remote access tools and tunnels, demonstrating high sophistication in maintaining persistence within compromised networks.

This operation’s success was partly due to using legitimate tools for remote access, such as AnyDesk, and the exploitation of security servers as gateways for further attacks.

The CACTUS ransomware attack is a stark reminder of the evolving threat landscape and the need for organizations to remain vigilant.

It emphasizes the criticality of promptly addressing known vulnerabilities and the benefits of employing robust cybersecurity defenses.

As cybercriminals continue to refine their tactics, the collaborative efforts of security professionals and the adoption of advanced protection technologies will be paramount in safeguarding against such sophisticated threats.        

IOCs

Name Type Hash
C:\windows\{Victim ID}.exe File 39fe99d2250954a0d5ed0e9ff9c41d81
C:\Windows\{Victim ID}.exe File 0e4ee38fe320cfb573a30820198ff442
./{Victim ID} File 8d2e4bef47e3f2ee0195926bbf4a25d5
C:\WINDOWS\so.bat File f7a6d1e6e5436bd3c10f3a26f3e9b9b9
C:\WINDOWS\f2.bat File fb467a07f44e8d58e93e3567fd7ff016
c:\user\public\syslog.txt File be139fc480984eb31de025f25a191035
c:\users\public\bk11.ps1 File 08d2c800c93015092e14738c941ac492
02e4da16377fc85e71a8c8378b2a8a96
Psnmap.ps1 File 8b37df9d295bbc2906961f72b7cdc5fb
Psnmap.ps1 File 8af259ad55c3746926e992c82bc7e850
Psnmap.ps1 File 55e42014424c0d120ff17f11e207e4f0
Psnmap.ps1 File 5f7c3cda7759ef6e577552ad322c1f64
64.52.80.252 C2
162.33.177.56 C2
45.61.138.99 C2
206.188.196.20 C2
45.61.136.79 C2
45.61.136.127 C2
85.206.172.127 Attacker IP
192.227.190.11 Attacker IP
154.18.12.125 Attacker IP
Win64 Scheduled Task
Win32 Scheduled Task
Windows Scheduled Task
Update Scheduled Task
Windows Update Scheduled Task
Microsoft Update Scheduled Task
GoogleUpdateTaskMachine Scheduled Task

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter

Leave a Reply

Your email address will not be published. Required fields are marked *