THREAT ACTOR
CACTUS_
DormantCACTUS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of CACTUS, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
371
Victims tracked
0 / 7
Active mirrors
2023-07-20
First listing
2025-03-17
Most recent
Victims by year
- 2025 94
- 2024 178
- 2023 99
Leak site mirrors
7 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion500: Internal Server Error snapshot · 2025-04-07 20:01 -
cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onionsnapshot · 2025-04-08 11:10 -
vhfd5qagh6j7qbisjqvly7eejqbv6z5bv77v6yuhctn77wmd3hjkyvad.onionsnapshot · 2025-04-28 08:08 -
acfckf3l6l7v2tsnedfx222a4og63zt6dmvheqbvsd72hkhaqadrrsad.onionsnapshot · 2025-04-28 15:23 -
6wuivqgrv2g7brcwhjw5co3vligiqowpumzkcyebku7i2busrvlxnzid.onionsnapshot · 2025-04-08 11:16 -
truysrv2txxvobngtlssbgqs3e3ekd53zl6zoxbotajyvmslp5rdxgid.onionsnapshot · 2025-04-21 03:19 -
jvtxo5gdcgloguty322ynfnpqkc2whe2jauc7ucm7bzmgct3k7ogr4yd.onionsnapshot · 2025-04-16 06:00
Recent victims
The 50 most recent victims claimed by CACTUS. Total in the index: 371.
| Date listed | Victim | Description |
|---|---|---|
| 2025-03-17 | rocketstores.com\$738.9M\USA\3.2TB\100% DISCLOSED | UPDATE! 100% Disclosed 3.2TB >> Download link #2 |
| 2025-03-17 | assaabloy.com\$14.4B\Sweden\229GB\ | |
| 2025-03-17 | kyb.com\$600.5M\USA\1.8TB\ | |
| 2025-03-17 | bluedge.com\$104.5M\USA\994GB\100% DISCLOSED | UPDATE! 100% Disclosed 994GB >> Download link #2 |
| 2025-03-17 | urban1.com\$460.3M\USA\2.5TB\100% DISCLOSED | UPDATE! 100% Disclosed 2.5TB >> Download link #2 |
| 2025-03-17 | tempel.com\$628.7M\USA\111GB\100% DISCLOSED | UPDATE! 100% Disclosed 111GB >> Download link #2 |
| 2025-03-17 | thermoid.com\$183.2M\USA\199GB\100% DISCLOSED | UPDATE! 100% Disclosed 199GB >> Download link #2 |
| 2025-03-17 | baillie.com\$130.5M\USA\52GB\100% DISCLOSED | UPDATE! 100% Disclosed 52GB >> Download link #2 |
| 2025-03-14 | chfindustries.com\$253.8M\USA\2.5TB\100% DISCLOSED | UPDATE! 100% Disclosed 2.5TB >> Download link #2 |
| 2025-03-12 | tempel.com\$628.7M\USA\111GB\ | |
| 2025-03-12 | thermoid.com\$183.2M\USA\199GB\ | |
| 2025-03-12 | baillie.com\$130.5M\USA\52GB\ | |
| 2025-03-12 | urban1.com\$460.3M\USA\2.5TB\ | |
| 2025-03-12 | rocketstores.com\$738.9M\USA\3.2TB\ | |
| 2025-03-11 | quigleyeye.com\$33.6M\USA\3.4TB\100% DISCLOSED | UPDATE! 100% Disclosed 3.4TB >> Download link #2 |
| 2025-03-10 | aiibeauty.com\$274.8M\USA\508GB\100% DISCLOSED | UPDATE! 100% Disclosed 508GB >> Download link #2 |
| 2025-03-10 | formanmills.com\$422.2M\USA\846GB\100% DISCLOSED | UPDATE! 100% Disclosed 846GB >> Download link #2 |
| 2025-03-10 | amalgamatedsugar.com\$764.8 M\USA\464GB\100% DISCLOSED | UPDATE! 100% Disclosed 464GB >> Download link #2 |
| 2025-03-10 | pace-usa.com\$134.4M\USA\65GB\100% DISCLOSED | UPDATE! 100% Disclosed 65GB >> Download link #2 |
| 2025-03-10 | steelwarehouse.com\$570.3M\USA\679GB\100% DISCLOSED | UPDATE! 100% Disclosed 679GB >> Download link #2 |
| 2025-03-10 | caltrol.com\$296.3M\USA\224GB\100% DISCLOSED | UPDATE! 100% Disclosed 224GB >> Download link #2 |
| 2025-03-07 | grede.com\$814.7M\USA\524GB\100% DISCLOSED | UPDATE! 100% Disclosed 524GB >> Download link #2 |
| 2025-03-07 | associatedasset.com\$288M\USA\26GB\100% DISCLOSED | UPDATE! 100% Disclosed 26GB >> Download link #2 |
| 2025-03-07 | alphabaking.com\$421.9M\USA\1TB\100% DISCLOSED | UPDATE! 100% Disclosed 1TB >> Download link #2 |
| 2025-03-06 | stanleyconsultants.com\$190.5M\USA\388GB\100% DISCLOSED | UPDATE! 100% Disclosed 388GB >> Download link #2 |
| 2025-03-06 | electrocraft.com\$190.1M\USA\477GB\100% DISCLOSED | UPDATE! 100% Disclosed 477GB >> Download link #2 |
| 2025-03-06 | holtcat.com\$1B\USA\868GB\100% DISCLOSED | UPDATE! 100% Disclosed 868GB >> Download link #2 |
| 2025-03-04 | almostfamousclothing.com\$183M\USA\375GB\100% DISCLOSED | UPDATE! 100% Disclosed 375GB >> Download link #2 |
| 2025-03-04 | ssmcoop.com\$22.5M\USA\26GB\100% DISCLOSED | UPDATE! 100% Disclosed 26GB >> Download link #2 |
| 2025-03-04 | everelgroup.com\$259M\Italy\440GB\100% DISCLOSED | UPDATE! 100% Disclosed 440GB >> Download link #2 |
| 2025-03-04 | regulvar.com\$253.5M\Canada\3.6TB\100% DISCLOSED | UPDATE! 100% Disclosed 3.6TB >> Download link #2 |
| 2025-03-04 | quigleyeye.com\$33.6M\USA\435GB\ | |
| 2025-03-02 | britannicahome.com\$20.6M\USA\2.8TB\100% DISCLOSED | UPDATE! 100% Disclosed 2.8TB >> Download link #2 |
| 2025-03-02 | kinseysinc.com\$74.9M\USA\675GB\100% DISCLOSED | UPDATE! 100% Disclosed 675GB >> Download link #2 |
| 2025-03-02 | steelerubber.com\$17.9M\USA\116GB\100% DISCLOSED | UPDATE! 100% Disclosed 116GB >> Download link #2 |
| 2025-03-02 | uniekinc.com\$37.5M\USA\1.8TB\100% DISCLOSED | UPDATE! 100% Disclosed 1.8TB >> Download link #2 |
| 2025-03-02 | midwayimporting.com\$43.7M\USA\915GB\100% DISCLOSED | UPDATE! 100% Disclosed 915GB >> Download link #2 |
| 2025-03-02 | revitalash.com\$21.5M\USA\1.2TB\100% DISCLOSED | UPDATE! 100% Disclosed 1.2TB >> Download link #2 |
| 2025-03-02 | bestbrands.com\$25.5M\USA\659GB\100% DISCLOSED | UPDATE! 100% Disclosed 659GB >> Download link #2 |
| 2025-03-02 | newhorizonsbaking.com\$163M\USA\455GB\100% DISCLOSED | UPDATE! 100% Disclosed 455GB >> Download link #2 |
| 2025-02-28 | curtisint.com\$37.2M\Canada\676GB\100% DISCLOSED | UPDATE! 100% Disclosed 676GB >> Download link #2 |
| 2025-02-28 | uniquehd.com\$13.7M\USA\429GB\100% DISCLOSED | UPDATE! 100% Disclosed 429GB >> Download link #2 |
| 2025-02-28 | stanleyconsultants.com\$190.5M\USA\388GB\ | |
| 2025-02-28 | electrocraft.com\$190.1M\USA\477GB\ | |
| 2025-02-28 | associatedasset.com\$288M\USA\26GB\ | |
| 2025-02-28 | grede.com\$814.7M\USA\524gb\ | |
| 2025-02-28 | branchgroup.com\$333M\USA\253GB\ | |
| 2025-02-26 | caltrol.com\$296.3M\USA\224gb\ | |
| 2025-02-26 | holtcat.com\$1B\USA\868GB\ | |
| 2025-02-26 | alphabaking.com\$421.9M\USA\1TB\ |
CONFIRMED ATTACKS
Cactus confirmed attacks: 61 verified incidents
Ransomnews has verified 61 Cactus incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from April 2023 to March 2025. United States accounts for 47 of them (77%), with victims recorded in 11 countries in total. The most affected sector is manufacturing, at 17 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 3; the outcome is unrecorded in the remaining 58. Where a figure was disclosed (37 cases), these incidents account for 438,542 exposed records.
61Verified incidents
11Countries
2023–2025Active range
0%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Cactus incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| March 2025 | Assa Abloy AB | Manufacturing | Stockholm, Sweden | — | Unknown | Source |
| February 2025 | Baillie Lumber Co. | Manufacturing | New York, United States | 740 | Unknown | Source |
| February 2025 | Amalgamated Sugar Company | Food and Beverage | Idaho, United States | 18,679 | Unknown | Source |
| February 2025 | Caltrol, Inc. | Service | Nevada, United States | — | Unknown | Source |
| February 2025 | KYB Americas Corporation | Manufacturing | Indiana, United States | 2,041 | Unknown | Source |
| February 2025 | Urban One, Inc. | Other | Maryland, United States | 1,770 | Unknown | Source |
| February 2025 | Tempel Steel Company, LLC | Manufacturing | Illinois, United States | 3,864 | Unknown | Source |
| January 2025 | Steel Warehouse Company LLC | Manufacturing | Indiana, United States | 750 | Unknown | Source |
| January 2025 | The Branch Group, Inc. | Construction | Virginia, United States | 5,941 | Unknown | Source |
| January 2025 | New Horizons Baking Company | Food and Beverage | Ohio, United States | 9,476 | Unknown | Source |
| January 2025 | Alpha Baking Co., Inc. | Food and Beverage | Illinois, United States | 21,463 | Unknown | Source |
| January 2025 | Athena Cosmetics, Inc. d/b/a RevitaLash Cosmetics | Manufacturing | California, United States | 422 | Unknown | Source |
| January 2025 | Kinsey's Archery Products, Inc. | Retail | Pennsylvania, United States | 1,330 | Unknown | Source |
| December 2024 | Holt Group | Other | Texas, United States | 12,455 | Unknown | Source |
| December 2024 | Cornwell Quality Tools | Manufacturing | Ohio, United States | 103,782 | Unknown | Source |
| December 2024 | Optiline Enterprises, LLC | Construction | New Hampshire, United States | 1,016 | Unknown | Source |
| December 2024 | Biagi Bros, Inc. | Transportation | California, United States | 2,696 | Unknown | Source |
| November 2024 | Physicians to Children & Adolescents | Healthcare | Kentucky, United States | 9,536 | Unknown | Source |
| October 2024 | Housing Authority of the City of Los Angeles (HACLA) | Government | Los Angeles, United States | — | Unknown | Source |
| August 2024 | Denkai America, Inc. | Manufacturing | South Carolina, United States | 780 | Unknown | Source |
| July 2024 | Rio Marine, Inc. | Service | Texas, United States | 1,908 | Unknown | Source |
| July 2024 | Balboa Bay Club Ventures LLC (BBCV), Newport Beach Country Club (NBCC), International Bay Clubs, LLC (IBC) | Other | California, United States | — | Unknown | Source |
| June 2024 | Word of God Fellowship, Inc. d/b/a Daystar Television Network | Other | Texas, United States | 1,695 | Unknown | Source |
| June 2024 | Massachusetts Development Finance Agency (MassDevelopment) | Government | Massachusetts, United States | 1,039 | Unknown | Source |
| June 2024 | Suminoe Textile of America Corporation | Manufacturing | South Carolina, United States | — | Unknown | Source |
| June 2024 | Sky-light A/S | Manufacturing | Varde, Denmark | — | No | Source |
| April 2024 | Sanyo Shokai | Manufacturing | Shinjuku, Japan | 1,500 | Unknown | Source |
| April 2024 | Schuette Inc. | Manufacturing | Wisconsin, United States | 1,122 | Unknown | Source |
| April 2024 | Iddink Group | Education | Ede, Netherlands | — | Unknown | Source |
| March 2024 | Regulator Marine, Inc. | Manufacturing | North Carolina, United States | 1,384 | Unknown | Source |
| March 2024 | DRM, Inc. (Arby's) | Food and Beverage | Nebraska, United States | 5,290 | Unknown | Source |
| February 2024 | Grupa Topex | Manufacturing | Warsaw, Poland | — | Unknown | Source |
| February 2024 | AB Texel Group | Transportation | Lelystad, Netherlands | — | Unknown | Source |
| February 2024 | McAlvain Companies | Construction | Idaho, United States | — | Unknown | Source |
| January 2024 | Nassau OOGP Vision Group | Healthcare | Oregon, United States | 504 | Unknown | Source |
| January 2024 | Advanced Project Solutions, LLP | Technology | Wisconsin, United States | — | Unknown | Source |
| January 2024 | Plymouth Tube Company | Manufacturing | Illinois, United States | 4,805 | Unknown | Source |
| January 2024 | Schneider Electric Sustainability Business | Utilities | Rueil-Malmaison, France | — | Unknown | Source |
| December 2023 | Acutis Diagnostics | Healthcare | New York, United States | — | Unknown | Source |
| December 2023 | Parksite, Inc. | Retail | Illinois, United States | 8,577 | Unknown | Source |
| December 2023 | Ascend Dedicated, LLC d/b/a Dedicated Transportation Solutions | Transportation | South Carolina, United States | 6,812 | Unknown | Source |
| December 2023 | Bachoco | Food and Beverage | Celaya, Mexico | — | Unknown | Source |
| December 2023 | Asbury Automotive Group | Retail | Georgia, United States | 41,571 | Unknown | Source |
| December 2023 | Coop Värmland | Food and Beverage | Karlstad, Sweden | — | No | Source |
| November 2023 | La Jolla Group | Retail | California, United States | 3,544 | Unknown | Source |
| November 2023 | GDI Integrated Facility Services, Inc. | Service | LaSalle, Canada | — | Unknown | Source |
| November 2023 | Quaker Window Products Co. | Manufacturing | Missouri, United States | 10,988 | Unknown | Source |
| November 2023 | Odalys Vacances | Other | Paris, France | — | No | Source |
| November 2023 | ISC Consulting Engineers | Service | Copenhagen, Denmark | — | Unknown | Source |
| October 2023 | Paul Stuart, Inc. | Retail | New York, United States | 2,288 | Unknown | Source |
| October 2023 | Axiom Construction & Consulting | Construction | Washington, United States | — | Unknown | Source |
| October 2023 | Petersen Health Care | Healthcare | Illinois, United States | — | Unknown | Source |
| October 2023 | GEOCOM Uruguay | Technology | Montevideo, Uruguay | — | Unknown | Source |
| September 2023 | OmniVision Technologies | Technology | California, United States | 4,525 | Unknown | Source |
| September 2023 | Spuncast, Inc. | Manufacturing | Wisconsin, United States | — | Unknown | Source |
| August 2023 | Bacon-Universal Holdings, LLC | Retail | Hawaii, United States | 3,561 | Unknown | Source |
| May 2023 | ScanSource | Technology | South Carolina, United States | — | Unknown | Source |
| April 2023 | American Meteorological Society | Other | Massachusetts, United States | 557 | Unknown | Source |
| April 2023 | Americold Logistics LLC | Transportation | Georgia, United States | 129,611 | Unknown | Source |
| April 2023 | Hawa Sliding Solutions AG | Retail | Mettmenstetten, Switzerland | — | Unknown | Source |
| April 2023 | The Wasserstrom Company | Retail | Ohio, United States | 10,520 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Cactus's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.