CACTUS Hackers Exploiting Software Bug to Attack Corporate Networks

Threat actors known as CACTUS orchestrated a sophisticated attack on two companies simultaneously, exploiting a software vulnerability within 24 hours of its disclosure.

This coordinated ransomware attack highlighted organizations’ growing risks in the digital landscape.

The attack involved intricate steps, including infiltrating networks, implanting remote access tools, encrypting workstations, and targeting virtualization infrastructure across different servers.

Rapid Exploitation of Vulnerabilities

The attack began less than 24 hours after disclosing a critical vulnerability in the Ivanti MobileIron Sentry, identified as CVE-2023-38035, with a CVSS score of 9.8.

This flaw allowed attackers to bypass authentication controls and execute code remotely.

The rapid weaponization of this vulnerability underscores a growing trend among cybercriminals to exploit software bugs swiftly, often before organizations can patch them.

CACTUS’s operation was not only swift but also meticulously coordinated.

The hackers initially infiltrated one organization’s network before moving on to another company within the same group.

Despite the companies operating independently with separate networks, the attackers managed to exploit the interconnectedness of some machines to launch simultaneous attacks on both entities.

The assault was multifaceted, involving data exfiltration and the encryption of workstations and virtual machines, including domain controllers.

Recently, Bitdefender Labs collaborated in an investigation that unfortunately confirms two significant predictions made for 2024: the swift proliferation of opportunistic ransomware and the growing sophistication of cyber attacks.

Key Points:

• Rapid Response: CACTUS swiftly capitalized on a Remote Code Execution (RCE) vulnerability, emphasizing the need for organizations to address such threats promptly.
• Meticulous Coordination: The attack was meticulously planned, with synchronized actions on both companies within a five-minute window
• Expanded Target Scope: CACTUS expanded its targets beyond Windows workloads to include ESXi and Hyper-V hosts, showcasing a broader focus
• Forensic Expertise: The affected companies sought forensic expertise from Bitdefender Labs instead of paying the ransom, demonstrating a proactive approach to handling cyber threats

Expanding Targets and Sophisticated Tactics

Traditionally focusing on Windows workloads, CACTUS has expanded its scope to include ESXi and Hyper-V hosts, indicating a broader targeting strategy.

The group employed various remote access tools and tunnels, demonstrating high sophistication in maintaining persistence within compromised networks.

This operation’s success was partly due to using legitimate tools for remote access, such as AnyDesk, and the exploitation of security servers as gateways for further attacks.

The CACTUS ransomware attack is a stark reminder of the evolving threat landscape and the need for organizations to remain vigilant.

It emphasizes the criticality of promptly addressing known vulnerabilities and the benefits of employing robust cybersecurity defenses.

As cybercriminals continue to refine their tactics, the collaborative efforts of security professionals and the adoption of advanced protection technologies will be paramount in safeguarding against such sophisticated threats.        

IOCs

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter