Cactus attacks Plymouth Tube Company

Incident Date:

March 11, 2024

World map



Cactus attacks Plymouth Tube Company


Plymouth Tube Co




Warrenville, USA

Illinois, USA

First Reported

March 11, 2024

Plymouth Tube Company Compromised by Cactus Ransomware Group

Plymouth Tube Company has been compromised by the Cactus ransomware group. The attack has reportedly led to the exfiltration of 1.83 TB of critical data encompassing accounting, treasury, taxes, HR - payrolls, personal documents, dossiers, customer data - projects, contracts, drawings, engineering, R&D, QA, legal documents, corporate correspondence, and employees' personal folders, hundreds of documents containing Personal Identifying Information, executive managers' personal and corporate documents, and engineering database backups. A ransom of $1,500,000 has been demanded.

Plymouth Tube Company is a global specialty manufacturer of carbon alloy, nickel alloy, and stainless precision steel tubing. Plymouth Engineered Shapes manufactures titanium, stainless, nickel alloy, carbon & alloy semi-finished extrusions and semi-finished shaped bars. Comprised of eight manufacturing plants and nine business units, Plymouth Tube is a family-owned company with fifth-generation leadership.

Cactus Ransomware Emergence

Cactus ransomware emerged in March of 2023 and has been steadily ramping up its attack volume through the end of 2023. Cactus is noted for its ability to evade security tools and leverage exploits for known vulnerabilities in common VPN appliances to gain initial access to the networks of targeted organizations. Cactus operators also have been observed running a batch script that unhooks common security tools.

Cactus is a new arrival on the RaaS (Ransomware-as-a-Service) scene but has quickly amassed a disturbing number of victims in a relatively short time, and attack volumes have escalated in the second and third quarters of 2023. Cactus employs an encrypted messaging platform called TOX chat to conduct negotiations with victims. Ransom demands are assessed to be quite substantial, but an average has not been established.

Techniques and Exploits Used by Cactus

Cactus operations employ Living-off-the-Land techniques to abuse legitimate network tools like Event Viewer, PowerShell, Chisel, Rclone, Scheduled Tasks and typically drops an SSH backdoor on systems for persistence and for communicating with the C2 servers. Cactus has also been observed leveraging legitimate remote access tools like Splashtop and SuperOps RMM, along with deploying Cobalt Strike.

In Q4-2023, Cactus operators were observed abusing Qlik Sense for initial access, as well as ManageEngine UEMS and AnyDesk for remote access and lateral movement on targeted networks. Cactus is unique in that the ransomware payload is encrypted and requires a key to execute to prevent it from being detected by security tools. It is also assessed that Cactus uses a PowerShell script dubbed TotalExec to automate the encryption process in a manner similar to the BlackBasta gang and that they attempt to dump LSASS credentials for future privilege escalation.

Cactus has been observed abusing SoftPerfect Network Scanner to do reconnaissance on prospective victims, who are generally large-scale commercial organizations across multiple sectors.

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.