Cactus

Cactus emerged in March 2023 and conducts double-extortion attacks. It is notable for gaining initial access through exploitation of vulnerabilities in public-facing appliances and remote-access products, and for using an encrypted/self-decrypting payload technique to hinder antivirus detection. Late in 2023 it ran a prominent campaign exploiting Qlik Sense vulnerabilities (CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365), with researchers identifying thousands of exposed servers and scores of compromised hosts.

Cactus remained active through 2024-2025, listing victims on its leak site across manufacturing, professional services and other sectors, and has been associated in reporting with broader access-broker ecosystems.

Cactus's leak site has listed victims in the UAE among its international claims. Such listings are extortion allegations and should be treated as claims, not confirmed breaches, unless independently verified.