CACTUS: Analyzing a Coordinated Ransomware Attack on Corporate Networks

MITRE Techniques

• [T1190] Exploit Public-Facing Application – The vulnerability CVE-2023-38035 was exposed and exploited to bypass authentication and enable remote code execution on the administrative interface. Quote: ‘a significant vulnerability (CVE-2023-38035) surfaced— a critical vulnerability … could enable an attacker to bypass authentication controls on the administrative interface due to an inadequately restrictive Apache HTTPD configuration and lead to remote code execution in the context of the root user.’
• [T1021.001] Remote Services – RDP, AnyDesk, and SSH access were used to move and control access across networks. Quote: ‘With RDP, AnyDesk, and SSH access, this security server functioned as a gateway for their attack on VictimA.’
• [T1046] Network Service Scanning – PSnmap.ps1 was used to scan ports and gather host details during network discovery. Quote: ‘a custom version of the PSnmap.ps1 script. This tool not only scans for ports 135 (RPC/WMI), 3389 (RDP), 445 (SMB), 443 (HTTPS), and 22 (SSH), but also extracts machine details…’
• [T1053.005] Scheduled Task – The attackers established multiple scheduled tasks via Group Policy Preferences to manage configurations and persistence. Quote: ‘Three scheduled tasks are established via Group Policy Preferences (GPO) to manage administrative and security configurations on both VictimA and VictimB networks.’
• [T1003.001] OS Credential Dumping – Credentials were extracted from LSA Secrets and domain controllers, enabling privilege escalation. Quote: ‘extract credentials for the VictimAendpoint account from LSA Secrets’
• [T1550.002] Pass the Hash – Disabling Restricted Admin mode facilitated logins using NTLM hash for lateral movement. Quote: ‘Disable Restricted Admin mode (to allows logging in with NTLM hash, enabling pass-the-hash attacks)’
• [T1041] Exfiltration Over C2 Channel – Data exfiltration occurred to known C2 IPs (206.188.196.20 and 64.52.80.252) on ports 22 or 443. Quote: ‘Data exfiltration occurred, as anticipated, prior to the onset of the ransomware attacks. For VictimA, this began on day T+1 and persisted until day T+20… the command and control servers used for exfiltration are known IP addresses: 206.188.196.20 and 64.52.80.252, operating on ports 22 or 443.’
• [T1486] Data Encrypted for Impact – The CACTUS ransomware encrypted all endpoints, including hypervisors and VMs, with two distinct Windows binaries and ESXi-specific variants. Quote: ‘The CACTUS ransomware encrypts all files except those with the following extensions: exe, dll, lnk, sys, msi, and bat…’
• [T1021.002] SMB/Windows Admin Shares – Brute force/password spraying attempts on SMB port 445 indicate lateral movement via Windows admin shares. Quote: ‘brute force/password spraying attempts on SMB port 445’