Latest Ransomware 'CACTUS' Variant Uses VPN Vulnerabilities to Penetrate Network

Investigators in the field of cybersecurity have put light on a brand-new ransomware outbreak identified as CACTUS, which has been discovered to use well-known vulnerabilities in VPN appliances to get early access to intended networks.

According to a statement discussed by Kroll, "At some point within the network, CACTUS participants try to identify local and network user profiles as well as accessible endpoints prior to forming fresh user accounts and utilizing customized scripts for automating the setting up and detonation of the ransomware encryptor via scheduled tasks."

Since March 2023, ransomware has been seen to target sizable businesses. Attacks use double extortion strategies to obtain sensitive data before they are encrypted. To date, no location of a data leak has been found.

An SSH gateway has been configured to keep continuous access after susceptible VPN devices have been successfully exploited, and an array of PowerShell instructions are run to do network scanning and compile a list of workstations that need to be encrypted.

Cobalt Strike, a tunneling tool known as Chisel, and remote monitoring and management (RMM) tools like AnyDesk are also used in CACTUS attacks for command and control and to push documents to the infected systems.

In addition, measures have been implemented to harvest login information from internet browsers and the Local Security Authority Subsystem Service (LSASS) for increasing privileges. Security programs are also disabled and uninstalled.

Lateral motion, theft of data, and malware installation follow elevated privileges, with the latter two being accomplished via a PowerShell script that has also been utilized by Black Basta.

The implementation of a batch script to open the ransomware binary with 7-Zip and then remove the .7z archive before carrying out the payload is a novel feature of CACTUS.

According to Laurie Iacono, assistant director of management for cyber risk at Kroll, "CACTUS effectively encodes itself, rendering it tougher to identify while helping it escape antivirus and network monitoring tools," she said.

Cyber Attackers keep targeting remote access services and unfixed vulnerabilities for first access, as evidenced by the fact that the new ransomware version known as CACTUS takes advantage of a flaw in a well-known VPN appliance.

The development come a few days after Trend Micro revealed Rapture, a different ransomware family that resembles previous families like Paradise.

After the first reconnaissance, Cobalt Strike is deployed, which is then used to distribute the .NET-based ransomware, according to the business. "The entire infection cycle extends between 3 and 5 days at most," it stated.

Enterprises must take action to keep systems updated and uphold the principle of least privilege (PoLP), as the intrusion is thought to have been made possible through weak public-facing websites and servers.

Despite the fact that its operators make use of easily accessible tools and resources, they have found a method for applying them so that Rapture is more stealthy and challenging to analyze, according to Trend Micro.

A number of fresh ransomware families have surfaced recently, notably Gazprom, BlackBit, UNIZA, Akira, and a NoCry variation known as Kadavro Vector. CACTUS and Rapture are the most recent to join this list.