{"id":8403,"date":"2023-05-07T15:24:01","date_gmt":"2023-05-07T06:24:01","guid":{"rendered":"https:\/\/cyberenso.jp\/?p=8403"},"modified":"2023-05-30T15:27:09","modified_gmt":"2023-05-30T06:27:09","slug":"kroll-reveals-new-cactus-ransomware-that-encrypts-itself-to-evade-antivirus","status":"publish","type":"post","link":"https:\/\/cyberenso.jp\/en\/kroll-reveals-new-cactus-ransomware-that-encrypts-itself-to-evade-antivirus\/","title":{"rendered":"Kroll reveals new Cactus ransomware that encrypts itself to evade antivirus"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"8403\" class=\"elementor elementor-8403\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-4fe1ba9 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"4fe1ba9\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2f5b324\" data-id=\"2f5b324\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4440a33 elementor-widget elementor-widget-text-editor\" data-id=\"4440a33\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>On Wednesday 10th of May 2023, Kroll revealed a new ransomware strain named &#8216;Cactus&#8217; which has been exploiting vulnerabilities in VPN appliances for initial access to networks of large commercial entities since March 2023.<\/p><p>The publication covering the strain revealed that the unique feature of the strain is its self-encryption capability. to make it difficult for antivirus software to detect the threat. Another notable characteristic of the strain is the use of multiple extensions for the files it targets, depending on the processing state. E.g., When preparing a file for encryption, Cactus changes its extension to .CTS0 which is then changed to .CTS1 after encryption.<\/p><p>At the moment there is no public information about the ransoms that Cactus demands from its victims, and it appears that they have not set up a leak site. However, the threat actor has threatened victims with publishing the stolen files unless they get paid.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>On Wednesday 10th of May 2023, Kroll revealed a new ransomware strain named &#8216;Cactus&#8217; which has been exploiting vulnerabilities in VPN appliances for initial access to networks of large commercial entities since March 2023. The publication covering the strain revealed that the unique feature of the strain is its self-encryption capability. to make it difficult for antivirus software to detect<span class=\"excerpt-hellip\"> [\u2026]<\/span><\/p>\n","protected":false},"author":1,"featured_media":8408,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[225,6,12,9,2,8,1],"tags":[],"class_list":["post-8403","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-heavy-industry","category-latest_news","category-read_article","category-ransomware_criminals","category-ce_news","category-industry_sector","category-uncategorized"],"acf":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/cyberenso.jp\/wp-content\/uploads\/2023\/05\/Picture1-10.jpg?fit=1377%2C872&ssl=1","_links":{"self":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts\/8403"}],"collection":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/comments?post=8403"}],"version-history":[{"count":6,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts\/8403\/revisions"}],"predecessor-version":[{"id":8411,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts\/8403\/revisions\/8411"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/media\/8408"}],"wp:attachment":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/media?parent=8403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/categories?post=8403"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/tags?post=8403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}