Cactus Ransomware Group's Attack on eClinical Solutions

The Cactus ransomware group has attacked eClinical Solutions, exfiltrating 3TB of data. This includes thousands of customer information, such as drug tests, clinical studies and reports, analytical data, corporate correspondence, and more. eClinical Solutions helps life sciences organizations around the world accelerate clinical development initiatives with expert biometrics services and the Elluminate Clinical Data Cloud – the foundation of digital trials. Together, the Elluminate platform and eClinical Biometrics Services give clients self-service access to all their data from one centralized location, plus advanced analytics that help them make smarter, faster business decisions.

Emergence and Tactics of Cactus Ransomware

Cactus ransomware emerged in March of 2023 and have been steadily ramping up their attack volume through the end of 2023. Cactus is noted for the ability to evade security tools and leverages exploits for known vulnerabilities in common VPN appliances to gain initial access to the networks of targeted organizations. Cactus operators also have been observed running a batch script that unhooks common security tools. Cactus is a new arrival on the RaaS scene but has quickly amassed a disturbing number of victims in a relatively short time, and attack volumes have escalated in the second and third quarters of 2023.

Cactus employs an encrypted messaging platform called TOX chat to conduct negotiations with victims. Ransom demands are assessed to be quite substantial, but an average has not been established. Cactus operations employ Living-off-the-Land techniques to abuse legitimate network tools like Event Viewer, PowerShell, Chisel, Rclone, Scheduled Tasks and typically drops an SSH backdoor on systems for persistence and for communicating with the C2 servers. Cactus has also been observed leveraging legitimate remote access tools like Splashtop, and SuperOps RMM along with deploying Cobalt Strike.

Advanced Techniques and Q4-2023 Activities

In Q4-2023, Cactus operators were observed abusing Qlik Sense for initial access, as well as ManageEngine UEMS and AnyDesk for remote access and lateral movement on targeted networks. Cactus is unique in that the ransomware payload is encrypted and requires a key to execute to prevent it from being detected by security tools. It is also assessed that Cactus uses a PowerShell script dubbed TotalExec to automate the encryption process in a manner similar to the BlackBasta gang, and that they attempt to dump LSASS credentials for future privilege escalation.

Cactus has been observed abusing SoftPerfect Network Scanner to do reconnaissance on prospective victims, who are generally large-scale commercial organizations across multiple sectors.