Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

CACTUS · Threat actor profile

// THREAT ACTOR

CACTUS_

Dormant

CACTUS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of CACTUS — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

371 Victims tracked
0 / 7 Active mirrors
2023-07-20 First listing
2025-03-17 Most recent

Victims by year

  • 2025 94
  • 2024 178
  • 2023 99

Leak site mirrors

7 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion 500: Internal Server Error snapshot · 2025-04-07 20:01
  • cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion snapshot · 2025-04-08 11:10
  • vhfd5qagh6j7qbisjqvly7eejqbv6z5bv77v6yuhctn77wmd3hjkyvad.onion snapshot · 2025-04-28 08:08
  • acfckf3l6l7v2tsnedfx222a4og63zt6dmvheqbvsd72hkhaqadrrsad.onion snapshot · 2025-04-28 15:23
  • 6wuivqgrv2g7brcwhjw5co3vligiqowpumzkcyebku7i2busrvlxnzid.onion snapshot · 2025-04-08 11:16
  • truysrv2txxvobngtlssbgqs3e3ekd53zl6zoxbotajyvmslp5rdxgid.onion snapshot · 2025-04-21 03:19
  • jvtxo5gdcgloguty322ynfnpqkc2whe2jauc7ucm7bzmgct3k7ogr4yd.onion snapshot · 2025-04-16 06:00

Recent victims

The 50 most recent victims claimed by CACTUS. Total in the index: 371.

Date listed Victim Description
2025-03-17 rocketstores.com\$738.9M\USA\3.2TB\100% DISCLOSED UPDATE! 100% Disclosed 3.2TB >> Download link #2
2025-03-17 assaabloy.com\$14.4B\Sweden\229GB\
2025-03-17 kyb.com\$600.5M\USA\1.8TB\
2025-03-17 bluedge.com\$104.5M\USA\994GB\100% DISCLOSED UPDATE! 100% Disclosed 994GB >> Download link #2
2025-03-17 urban1.com\$460.3M\USA\2.5TB\100% DISCLOSED UPDATE! 100% Disclosed 2.5TB >> Download link #2
2025-03-17 tempel.com\$628.7M\USA\111GB\100% DISCLOSED UPDATE! 100% Disclosed 111GB >> Download link #2
2025-03-17 thermoid.com\$183.2M\USA\199GB\100% DISCLOSED UPDATE! 100% Disclosed 199GB >> Download link #2
2025-03-17 baillie.com\$130.5M\USA\52GB\100% DISCLOSED UPDATE! 100% Disclosed 52GB >> Download link #2
2025-03-14 chfindustries.com\$253.8M\USA\2.5TB\100% DISCLOSED UPDATE! 100% Disclosed 2.5TB >> Download link #2
2025-03-12 tempel.com\$628.7M\USA\111GB\
2025-03-12 thermoid.com\$183.2M\USA\199GB\
2025-03-12 baillie.com\$130.5M\USA\52GB\
2025-03-12 urban1.com\$460.3M\USA\2.5TB\
2025-03-12 rocketstores.com\$738.9M\USA\3.2TB\
2025-03-11 quigleyeye.com\$33.6M\USA\3.4TB\100% DISCLOSED UPDATE! 100% Disclosed 3.4TB >> Download link #2
2025-03-10 aiibeauty.com\$274.8M\USA\508GB\100% DISCLOSED UPDATE! 100% Disclosed 508GB >> Download link #2
2025-03-10 formanmills.com\$422.2M\USA\846GB\100% DISCLOSED UPDATE! 100% Disclosed 846GB >> Download link #2
2025-03-10 amalgamatedsugar.com\$764.8 M\USA\464GB\100% DISCLOSED UPDATE! 100% Disclosed 464GB >> Download link #2
2025-03-10 pace-usa.com\$134.4M\USA\65GB\100% DISCLOSED UPDATE! 100% Disclosed 65GB >> Download link #2
2025-03-10 steelwarehouse.com\$570.3M\USA\679GB\100% DISCLOSED UPDATE! 100% Disclosed 679GB >> Download link #2
2025-03-10 caltrol.com\$296.3M\USA\224GB\100% DISCLOSED UPDATE! 100% Disclosed 224GB >> Download link #2
2025-03-07 grede.com\$814.7M\USA\524GB\100% DISCLOSED UPDATE! 100% Disclosed 524GB >> Download link #2
2025-03-07 associatedasset.com\$288M\USA\26GB\100% DISCLOSED UPDATE! 100% Disclosed 26GB >> Download link #2
2025-03-07 alphabaking.com\$421.9M\USA\1TB\100% DISCLOSED UPDATE! 100% Disclosed 1TB >> Download link #2
2025-03-06 stanleyconsultants.com\$190.5M\USA\388GB\100% DISCLOSED UPDATE! 100% Disclosed 388GB >> Download link #2
2025-03-06 electrocraft.com\$190.1M\USA\477GB\100% DISCLOSED UPDATE! 100% Disclosed 477GB >> Download link #2
2025-03-06 holtcat.com\$1B\USA\868GB\100% DISCLOSED UPDATE! 100% Disclosed 868GB >> Download link #2
2025-03-04 almostfamousclothing.com\$183M\USA\375GB\100% DISCLOSED UPDATE! 100% Disclosed 375GB >> Download link #2
2025-03-04 ssmcoop.com\$22.5M\USA\26GB\100% DISCLOSED UPDATE! 100% Disclosed 26GB >> Download link #2
2025-03-04 everelgroup.com\$259M\Italy\440GB\100% DISCLOSED UPDATE! 100% Disclosed 440GB >> Download link #2
2025-03-04 regulvar.com\$253.5M\Canada\3.6TB\100% DISCLOSED UPDATE! 100% Disclosed 3.6TB >> Download link #2
2025-03-04 quigleyeye.com\$33.6M\USA\435GB\
2025-03-02 britannicahome.com\$20.6M\USA\2.8TB\100% DISCLOSED UPDATE! 100% Disclosed 2.8TB >> Download link #2
2025-03-02 kinseysinc.com\$74.9M\USA\675GB\100% DISCLOSED UPDATE! 100% Disclosed 675GB >> Download link #2
2025-03-02 steelerubber.com\$17.9M\USA\116GB\100% DISCLOSED UPDATE! 100% Disclosed 116GB >> Download link #2
2025-03-02 uniekinc.com\$37.5M\USA\1.8TB\100% DISCLOSED UPDATE! 100% Disclosed 1.8TB >> Download link #2
2025-03-02 midwayimporting.com\$43.7M\USA\915GB\100% DISCLOSED UPDATE! 100% Disclosed 915GB >> Download link #2
2025-03-02 revitalash.com\$21.5M\USA\1.2TB\100% DISCLOSED UPDATE! 100% Disclosed 1.2TB >> Download link #2
2025-03-02 bestbrands.com\$25.5M\USA\659GB\100% DISCLOSED UPDATE! 100% Disclosed 659GB >> Download link #2
2025-03-02 newhorizonsbaking.com\$163M\USA\455GB\100% DISCLOSED UPDATE! 100% Disclosed 455GB >> Download link #2
2025-02-28 curtisint.com\$37.2M\Canada\676GB\100% DISCLOSED UPDATE! 100% Disclosed 676GB >> Download link #2
2025-02-28 uniquehd.com\$13.7M\USA\429GB\100% DISCLOSED UPDATE! 100% Disclosed 429GB >> Download link #2
2025-02-28 stanleyconsultants.com\$190.5M\USA\388GB\
2025-02-28 electrocraft.com\$190.1M\USA\477GB\
2025-02-28 associatedasset.com\$288M\USA\26GB\
2025-02-28 grede.com\$814.7M\USA\524gb\
2025-02-28 branchgroup.com\$333M\USA\253GB\
2025-02-26 caltrol.com\$296.3M\USA\224gb\
2025-02-26 holtcat.com\$1B\USA\868GB\
2025-02-26 alphabaking.com\$421.9M\USA\1TB\

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.