Prickly Cactus (Cactus) ransomware gains access by exploiting vulnerabilities in externally facing VPNs and uses SSH for C2, deploying double extortion with encryption and data exfiltration. AttackIQ’s emulation template models Cactus-like TTPs to help security teams test and improve detection and response capabilities. #CactusRansomware #PricklyCactus #Trellix #ShadowStackRE #SecurityScorecard
Keypoints
- Cactus typically gains initial access by exploiting vulnerabilities in publicly facing VPNs and establishes SSH as the C2 channel.
- It uses double extortion, encrypting data and exfiltrating it to pressure victims to pay.
- AttackIQ released a dedicated emulation template to assess security controls against Cactus-like behaviors and validate detection/prevention pipelines.
- The emulation covers early actions (persistence, account creation, and SSH usage) such as creating a new local admin account and using scheduled tasks for persistence.
- Payload staging and delivery rely on RunOnce registry Run Keys, encoded PowerShell, and Ingress Tool Transfer to fetch/load components (e.g., f2.bat).
- The ransomware deployment sequence includes data encryption, shadow copy deletion, and system discovery (process, disk, and file enumeration).
- The article maps multiple MITRE techniques (e.g., T1105, T1053.005, T1486, T1547.001) and provides detection/mitigation guidance for defenders.
MITRE Techniques
- [T1021.004] SSH – Brief description of how it was used. ‘This scenario will initiate an SSH connection to an external AttackIQ-hosted server to exercise restrictions in outbound traffic.’
- [T1053.005] Scheduled Task – Brief description of how it was used. ‘This scenario acquires persistence through the creation of a new scheduled task using the schtasks utility.’
- [T1136.001] Create Account: Local Account – Brief description of how it was used. ‘This scenario creates a new account with the name AdmInBac using the net user command.’
- [T1098] Account Manipulation – Brief description of how it was used. ‘This scenario adds a local user to a local group using the net localgroup command.’
- [T1105] Ingress Tool Transfer – Brief description of how it was used. ‘This scenario downloads to memory and saves to disk in independent scenarios to test network and endpoint controls and their ability to prevent the delivery of known malicious samples.’
- [T1547.001] Run Keys/Startup Folder – Brief description of how it was used. ‘This scenario sets the HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce registry key that Windows uses to identify what applications should be run at system startup.’
- [T1059.001] PowerShell – Brief description of how it was used. ‘This scenario encodes a user-defined PowerShell script into base64 and then executes it using PowerShell’s -encodedCommand parameter.’
- [T1490] Inhibit System Recovery – Brief description of how it was used. ‘This scenario executes the vssadmin.exe utility to delete a recent Volume Shadow Copy created by the assessment template.’
- [T1486] Data Encrypted for Impact – Brief description of how it was used. ‘This scenario performs the file encryption routines used by common ransomware families.’
Indicators of Compromise
- [File] f2.bat, vssadmin.exe – Stage payloads and utility usage during deployment. – f2.bat, vssadmin.exe
- [Registry] RunOnce key HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce – Used to run persistence items at startup. – HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce
- [Process] powershell.exe, cmd.exe – PowerShell and CMD usage during execution. – powershell.exe, cmd.exe
- [Event] Event ID 4624 – Logs of user logons that provide onboarding context. – Event ID 4624
- [Account] AdmInBac – Local user created for persistence. – AdmInBac
Read more: https://www.attackiq.com/2024/07/25/emulating-prickly-cactus/