The Cactus ransomware group emerged on the dark web in March 2024, wreaking havoc on commercial entities, and targeting global organizations. Named after its ransom note file, “cAcTuS.readme.txt,” it encrypts files with the .CTSx extension, where x varies.

Operating as a Ransomware-as-a-Service (RaaS) model, Cactus ransomware has displayed the ability to exploit new vulnerabilities and alter its methods to target unique victims in multiple industries.

Notably, it hit Schneider Electric in January 2024, compromising its Sustainability Business division, and impacting major clients like Clorox and Walmart. Other victims include Marfrig Global Foods and MINEMAN Systems, affecting global supply chains. The extent of Cactus’s reach is vast, with over 100 listed victims and potentially many more undisclosed ransom payers.