Who is Cactus?

The Cactus ransomware group is a relative newcomer, targeting major commercial enterprises since March 2023. Since then, it has established a strong foothold in the ransomware ecosystem by targeting organisations across the globe (but mostly the US and Europe), and within various sectors. At least 115 organisations appear to have been compromised by Cactus. We estimate the actual number of victims likely to be far higher, as victims that pay the ransom are not published on the Cactus leak-site.

The group is known for its complex attacks, using advanced techniques for encryption and detection evasion. Initial access is mostly gained by exploiting vulnerabilities in VPNs or other edge devices. Extortion is double in nature: both by encrypting data and by leaking and threatening to publish data. Cactus seems to be working on an affiliate-base, also known as Ransomware-as-a-Service (RaaS). This presumption is based on different domain names used in attacks by Cactus, which seemingly belong to different affiliates that perform these attacks.

Cactus pricks the vulnerable

In January and April 2024, Northwave responded to two separate incidents of organisations that were hit by the Cactus ransomware group. Our investigations showed that the initial stage of the attacks was very similar. And notably, both involved exploitation of the Qlik Sense vulnerabilities. In both cases, the internet facing Qlik Sense server had not been patched yet. The exploitation of the vulnerabilities by Cactus is in line with the publication of Arctic Wolf in November 2023 about a detected Qlik Sense exploitation campaign by Cactus.¹

Below, by providing insight into these incidents, we describe how Cactus exploits organisations that are still vulnerable. It is important to note here that as long as Qlik Sense servers remain unpatched, Cactus and other threat actors will continue to do so.

The first case

In the case we responded to last January, the threat actor exploited the victim’s Qlik Sense instance on 3 December 2023. We found exploitation traces of the Qlik Sense application for the vulnerability publicly known as ZeroQlik, which weaponised the vulnerabilities documented in CVE-2023-41266² and CVE-2023-41265³. The vulnerability CVE-2023-41266 is a path traversal vulnerability which allowed the (unauthenticated) threat actor to create an anonymous session on a Qlik Sense application. The vulnerability CVE-2023-41265 allowed the threat actor to elevate its privileges to a service account and execute these requests under the rights of this service account. The bypass for the incomplete mitigation is recorded under CVE-2023-48365⁴ and is dubbed DoubleQlik. Whether the combination of CVE-2023-41266 and CVE-2023-41265, or CVE-2023-48365 is abused cannot be determined by analysing Qlik Sense logs.

Roughly an hour after having exploited the Qlik Sense instance, the threat actor deployed the remote management tool ManageEngine UEMS⁵ for remote access. The executable of ManageEngine UEMS was renamed to “AcRes.exe”, similar to Arctic Wolf’s case findings. ManageEngine UEMS was configured to connect back to the IP address 172.86.66[.]52. This IP address appeared to have hosted a file called ‘QlikSens_patch_november.zip’⁶, which is again in line with Arctic Wolf’s findings. The threat actor then went silent for over a month, and resurfaced on 17 January 2024, laterally moving through the network via Remote Desk Protocol (RDP) and exfiltrating data via Rclone⁷. Rclone is a legitimate tool to synchronise data with cloud storage, however it is often used by ransomware threat actors to exfiltrate data from victim environments. Throughout the attack, the threat actor used PuTTY Link⁸ (a command-line connection tool) to covertly setup RDP connections from the internet or other internal systems to stay hidden and/or bypass network firewall restrictions.

About a week later, on 23 January 2024, the threat actor finally deployed ransomware throughout the IT environment. Just an hour before, a large amount of data had been exfiltrated for the purpose of double extortion.

The second case

In the case in April 2024, we found that the threat actor exploited the victim’s Qlik Sense platform on 4 December 2023, one day after the first case.

Unlike the other case, the threat actor did not seem to immediately leverage his foothold, as the first subsequent sign of activity took place only two weeks later, on 19 December 2023. At that time, the threat actor installed Zoho Assist⁹ for remote access. This is a legitimate remote management tool which can be used in a malicious manner by threat actors. Cactus is known for abusing legitimate remote management tools to obtain persistence in a network¹⁰.

After that, the threat actor similarly went silent for months, only to reappear on 7 March 2024 to (again) install ManageEngine UEMS. No sign of activity was observed for another month and on 1 April the threat actor started leveraging his foothold. They laterally moved through the network via RDP and exfiltrated a large amount of data via Rclone. Two days later, Cactus ransomware was deployed on 3 April 2024.

Putting the pieces together

The threat actor’s modus operandi in both our cases and the case Arctic Wolf’s described before, contained many similarities. Using the Unified Kill Chain model, we can break up the incidents we investigated in three distinct phases:

• In - How did the attackers gain access to the network?
• Through - How did the attackers move through the network?
• Out - How did they use the network access to monetise the attack?

The attacks can then be summarised as follows:

To us it seemed that the threat actor(s) behind the Cactus ransomware group have been continuously leveraging the same vulnerability since (at least) December 2023, one victim at a time. We estimate that this pace is being dictated by the available capacity within the Cactus group.

As both our cases show, organisations that are vulnerable to the Qlik Sense exploits (see timeline below) have a high risk of being compromised by threat actors like Cactus within a short timeframe.

Timeline of the events

Below we collected all the events from the disclosure of the Qlik Sense vulnerabilities in August last year, to the notification of (potential) victims earlier this month.

What does this timeline tell us? Above all, that even months after vulnerabilities are disclosed, and patch advises are issued, threat actors like Cactus are still able to exploit them and make numerous victims.

How we joined forces

Already during the ongoing incident response engagements, Northwave already collaborated via “project Melissa” with Responders.NU, comparing notes on interacting and negotiating with the threat actors.

Discussing the findings of the forensic investigations within “project Melissa” made it clear that we were not the only ones seeing the relation between Qlik Sense and Cactus ransomware deployment. Other members and partners also came to the same conclusion. By sharing data, we were able to create a common, more complete understanding of how the attacks worked.

With these insights, Fox-IT developed a fingerprint to identify both vulnerable and compromised Qlik Sense instances (for more details, see the blogpost of Fox-IT). Given that there were still a lot of vulnerable servers, as well as likely compromised servers, it was decided to notify the owners of those systems. This way we could prevent ransomware incidents from happening.

Cyberveilig Nederland within “project Melissa” then collaborated with the Dutch Nationaal Cyber Security Centrum (NCSC), the Digital Trust Center (DTC), Team High Tech Crime of the Dutch police, and the Dutch Institute for Vulnerability Disclosure (DIVD) to notify victims of compromised and vulnerable Qlik Sense instances in the world, as can be read in the press release.

Conclusion, and what can be done?

The cases that we describe in this article confirm once again how cybercriminals (but also other threat actors like nation state actors) continuously exploit new vulnerabilities. Internet facing edge devices in particular pose a serious risk for being exploited to gain unauthorised access to networks. Once access has been secured, it will be a matter of time before they wreak havoc by exfiltrating data, deploying ransomware or performing other types of attacks. Moreover, it often takes time before vulnerable systems are properly patched. This can partly be explained by the overload of advisories every day. But whatever the cause may be, threat actors ruthlessly make use of this and target whoever they find using these unpatched systems.

This underlines the need to timely prioritise and mitigate these risks by proper vulnerability and patch management. Moreover, solid monitoring solutions - like Managed Detection and Response (MDR) - are crucial for controlling and mitigating the risk of being compromised in this way.

At the same time, we and our partners within Melissa continue to prove the utmost importance of sharing data and insights to be able to combat ransomware together. This is the way forward to jointly raise our defenses and to enable law enforcement to target the most relevant cybercriminal groups and their facilitators. By doing so, we will keep building substantial pressure on the cybercriminal business model of ransomware and improve overall cyber security.

IoCs

The following table contains a combined view of relevant indicators of compromise (IOCs) found by Northwave, Fox-IT and ESET.

[1] https://arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/

[2] https://nvd.nist.gov/vuln/detail/CVE-2023-41266

[3] https://nvd.nist.gov/vuln/detail/CVE-2023-41265

[4] https://nvd.nist.gov/vuln/detail/CVE-2023-48365

[5] https://www.manageengine.com/unified-endpoint-management-security.html

[6] https://www.virustotal.com/gui/url/798a2dbc0c9f6053afea0e39429d022bf77f48408fa1143c3b8986e3d16c0847/details

[7] https://rclone.org/

[8] https://www.putty.org/

[9] https://www.zoho.com/nl/assist/

[10] https://www.csoonline.com/article/575275/new-ransomware-group-cactus-abuses-remote-management-tools-for-persistence.html

[11] https://diskanalyzer.com/