Skip to content
Leak site of cactus, captured by ThreatCluster

cactus

Inactive

25 tracked victims · First seen Jul 3, 2023 · Last seen Mar 17, 2025

About

Summarised by ThreatCluster from the group's own leak site

Cactus ransomware group Tor leak site homepage screenshot shows a message to stop scanning and to request authorization, with typical elements like victim names and banners but no visible victim data on the page excerpt.

Sectors: Business Services, Manufacturing, Technology · Countries: US, CA, GB

Recent victims

View all →
VictimSectorCountryPostedStatus
optiline.comNot FoundEEMar 21, 2025
fplfood.comAgriculture and Food ProductionUSMar 21, 2025
biagibros.comTransportation/LogisticsUSMar 21, 2025
assaabloy.comManufacturingSEMar 17, 2025
kyb.comTechnologyJPMar 17, 2025
tempel.comTechnologyUSMar 12, 2025
thermoid.comManufacturingUSMar 12, 2025
baillie.comNot FoundUSMar 12, 2025
urban1.comTechnologyUSMar 12, 2025
rocketstores.comNot FoundUSMar 12, 2025
quigleyeye.comHealthcareUSMar 3, 2025
stanleyconsultants.comBusiness ServicesUSFeb 28, 2025
caltrol.comTechnologyUSFeb 26, 2025
holtcat.comManufacturingUSFeb 26, 2025
alphabaking.comAgriculture and Food ProductionUSFeb 26, 2025
bluedge.comTechnologyUSFeb 25, 2025
lifting.comNot FoundUSFeb 25, 2025
chfindustries.comManufacturingUSFeb 24, 2025
aiibeauty.comConsumer ServicesUSFeb 24, 2025
formanmills.comConsumer ServicesUSFeb 24, 2025
amalgamatedsugar.comAgriculture and Food ProductionUSFeb 24, 2025
everelgroup.comManufacturingITFeb 24, 2025
regulvar.comNot FoundCAFeb 24, 2025
electrocraft.comTechnologyUSFeb 24, 2025
associatedasset.comFinancial ServicesUSFeb 24, 2025

All ransomware groups · Dark web intelligence