Cactus attacks SPB Globa

Date:

February 6, 2024

World map

Overview

Title

Cactus attacks SPB Globa

Victim

SPB Global

Attacker

Cactus

Location

Huévar del Aljarafe, Spain

Huévar del Aljarafe, Seville

Size of Attack

Unknown/TBD

First Reported

February 6, 2024

Last Updated

October 31, 2022

Cleaning products manufacturer, SPB Global, has been attacked by the Cactus ransomware group. Security Boulevard’s preliminary investigation into the exposed identities revealed a worrying trend - many of the victims’ data were also compromised in previous, well-known data breaches, such as phonehouse.es, scrapped data from LinkedIn, Data broker sites, and more. Cactus ransomware emerged in March of 2023 and have been steadily ramping up their attack volume through the end of 2023. Cactus is noted for the ability to evade security tools and leverages exploits for known vulnerabilities in common VPN appliances to gain initial access to the networks of targeted organizations. Cactus operators also have been observed running a batch script that unhooks common security tools. Cactus is a new arrival on the RaaS scene but has quicky amassed a disturbing number of victims in a relatively short time, and attack volumes have escalated in the second and third quarters of 2023. Cactus employs an encrypted messaging platform called TOX chat to conduct negotiations with victims. Ransom demands are assessed to be quite substantial, but an average has not been established. Cactus operations employ Living-off-the-Land techniques to abuse legitimate network tools like Event Viewer, PowerShell, Chisel, Rclone, Scheduled Tasks and typically drops an SSH backdoor on systems for persistence and for communicating with the C2 servers. Cactus has also been observed leveraging legitimate remote access tools like Splashtop, and SuperOps RMM along with deploying Cobalt Strike. In Q4-2023, Cactus operators were observed abusing Qlik Sense for initial access, as well as ManageEngine UEMS and AnyDesk for remote access and lateral movement on targeted networks. Cactus is unique in that the ransomware payload is encrypted and requires a key to execute to prevent it from being detected by security tools. It is also assessed that Cactus uses a PowerShell script dubbed TotalExec to automate the encryption process in a manner similar to the BlackBasta gang, and that they attempt to dump LSASS credentials for future privilege escalation. Cactus has been observed abusing SoftPerfect Network Scanner to do reconnaissance on prospective victims, who are generally large-scale commercial organizations across multiple sectors.

Oh no!

This attack's description was not found, while we work on the detailed account of this attack we invite you to browse through other recent Rasomware Attacks in the table below.

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.

8Base attacks YRW Limited
Date
February 7, 2024
Ransomware group
8Base
Location

Tauranga, New Zealand

, New Zealand

Industry
Professional, Scientific & Technical Services
Victim
YRW Limited
8Base attacks YRW Limited
Date
February 7, 2024
Ransomware group
8Base
Location

Tauranga, New Zealand

, New Zealand

Industry
Professional, Scientific & Technical Services
Victim
YRW Limited
LockBit attacks Vimar Equipment
Date
February 7, 2024
Ransomware group
LockBit
Location

Burnaby, Canada

British Colombia, Canada

Industry
Manufacturing
Victim
Vimar Equipment
LockBit attacks Vimar Equipment
Date
February 7, 2024
Ransomware group
LockBit
Location

Burnaby, Canada

British Colombia, Canada

Industry
Manufacturing
Victim
Vimar Equipment
8Base attacks CERALP
Date
February 7, 2024
Ransomware group
8Base
Location

Villefranche sur Saône, France

Rhone, France

Industry
Professional, Scientific & Technical Services
Victim
CERALP
8Base attacks CERALP
Date
February 7, 2024
Ransomware group
8Base
Location

Villefranche sur Saône, France

Rhone, France

Industry
Professional, Scientific & Technical Services
Victim
CERALP
Cactus attacks SPB Globa
Date
February 6, 2024
Ransomware group
Cactus
Location

Huévar del Aljarafe, Spain

Seville, Spain

Industry
Manufacturing
Victim
SPB Global
Cactus attacks SPB Globa
Date
February 6, 2024
Ransomware group
Cactus
Location

Huévar del Aljarafe, Spain

Seville, Spain

Industry
Manufacturing
Victim
SPB Global
Play attacks Virgin Islands Lottery
Date
February 6, 2024
Ransomware group
Play
Location

St Thomas,

,

Industry
Other
Victim
Virgin Islands Lottery
Play attacks Virgin Islands Lottery
Date
February 6, 2024
Ransomware group
Play
Location

St Thomas,

,

Industry
Other
Victim
Virgin Islands Lottery
Black Basta attacks Asecos
Date
February 6, 2024
Ransomware group
BlackBasta
Location

Gründau, Germany

, Germany

Industry
Other
Victim
Asecos
Black Basta attacks Asecos
Date
February 6, 2024
Ransomware group
BlackBasta
Location

Gründau, Germany

, Germany

Industry
Other
Victim
Asecos
LockBit attacks Logtainer
Date
February 5, 2024
Ransomware group
LockBit
Location

Milan, Italy

, Italy

Industry
Transportation & Warehousing
Victim
Logtainer
LockBit attacks Logtainer
Date
February 5, 2024
Ransomware group
LockBit
Location

Milan, Italy

, Italy

Industry
Transportation & Warehousing
Victim
Logtainer
LockBit attacks Portline
Date
February 5, 2024
Ransomware group
LockBit
Location

Lisbon, Portugal

, Portugal

Industry
Transportation & Warehousing
Victim
Portline
LockBit attacks Portline
Date
February 5, 2024
Ransomware group
LockBit
Location

Lisbon, Portugal

, Portugal

Industry
Transportation & Warehousing
Victim
Portline
LockBit attacks TGestiona Logistica Company
Date
February 5, 2024
Ransomware group
LockBit
Location

Sertãozinho Maua, Brazil

, Brazil

Industry
Transportation & Warehousing
Victim
TGestiona Logística Company
LockBit attacks TGestiona Logistica Company
Date
February 5, 2024
Ransomware group
LockBit
Location

Sertãozinho Maua, Brazil

, Brazil

Industry
Transportation & Warehousing
Victim
TGestiona Logística Company
LockBit attacks Prima
Date
February 5, 2024
Ransomware group
LockBit
Location

Fresno,

California,

Industry
Agriculture
Victim
Prima
LockBit attacks Prima
Date
February 5, 2024
Ransomware group
LockBit
Location

Fresno,

California,

Industry
Agriculture
Victim
Prima