Ransomware Profile: `CTS*` (aka “Cactus”)

Technical Breakdown

1. File Extension & Renaming Patterns

Confirmation of File Extension: Encrypted files are appended with “.cts1”, “.cts2”, “.cts3”, … “.cts99” (the integer after cts increments with successive variants/strains).
Renaming Convention:
Original → <original filename.ext>.cts<nn> (e.g., Budget2024.xlsx.cts3)
The malware also drops a counter-copy that retains the old size but zeroes-out 16–32 kB blocks (a double-extortion tactic to prevent rapid cloud-sync corruption reversal).
An additional read-only hidden NTFS stream (filename.ext:CTS) stores partial marker metadata (timestamp, victim ID) used by the affiliate dashboard.

2. Detection & Outbreak Timeline

Approximate Start Date: March–April 2023. First public incident attributed to a North-American manufacturer (May 3, 2023).
Major Surge Observed: June–August 2023 (LockBit/BlackCat winds down → affiliates migrated to Cactus/CTS*). Ongoing wave still peaks weakly around mid-quarter earnings cycles.

3. Primary Attack Vectors

| Vector | Method | Notes |
|——–|——–|——-|
| VPN appliances (Fortinet & Ivanti CVE chains) | Actively exploits CVE-2022-42475, CVE-2023-34362, and CVE-2023-26360. | Initial foothold via webshell “settings.php.cts” in /var/tmp/ |
| RDP brute-force / Credential stuffing | Scans TCP 3389 using previously harvested NetNTLMv2 hashes. | Drops custom .NET loader (“rdpwrap.exe.cts”) through WMI. |
| Phishing (fake MS Teams / Acrobat installers) | Targets csproj.zip lures. Payload is an MSI that sideloads a legitimate Electron app with malicious node.dll patched to spawn cactus.dll.enc (AES). |
| Living-off-the-land abuse | Utilizes certutil, rundll32, powershell.exe -enc and MsiExec /y to stage and decrypt the AES-wrapped core binary. |
| Lateral movement | Uses HOSTS file poisoning to re-point MSP backup servers to sinkhole pool 192.168.88.10, killing dedup processes. |

Remediation & Recovery Strategies

1. Prevention Essentials

Patch EOL VPN & SSL clients immediately—especially FortiOS < 7.0.10 and Ivanti <= 202302.
Disable SMBv1, enforce NTLM channel-binding and 30-day password-reset cycles.
Segment backup VLAN (L3 ACL 10.10.40.0/24 –> 10.10.42.0/24 deny all but Veeam).
AppLocker / WDAC whitelisting: block rundll32.exe & certutil.exe from uncertified directories.
3-2-1-1 rule (3 copies, 2 media, 1 off-site, 1 immutable—e.g., Veeam hardened repository with S3 Object Lock).
YARA sentinel rule (provided below):

rule cts_ransomware_dropper {
  strings:
    $a = "CtsLoaderMain" wide
    $b = ".cts1" ascii
  condition:
    uint16(0) == 0x5a4d and any of them
}

2. Removal

Physical isolation: unplug network, disable Wi-Fi/Bluetooth.
Identify encrypted fruit-clones (“.cts*” + zeroed 16 kB blocks).
Kill inducted processes:

   taskkill /F /IM ctsloader[*].exe
   taskkill /F /IM cactus.exe

Service cleanup: delete registry beads autoloaded under
HKLM\Software\Microsoft\Windows\CurrentVersion\Run named CTS or Cactus.
All staging folders purge:

   del /q "%ProgramData%\csTemp\*.cts[0-9]*"

Scan with a next-gen AV + CLI rootkit (CrowdStrike Falcon, Sophos Central, or SentinelOne Ranger).
Roll credentials (domain, service-accounts) & reset VPN seeds.

3. File Decryption & Recovery

Recovery Feasibility: As of this writing, no free public decryptor exists (ChaCha20-Poly1305 + RSA-4096 keys held off-site by affiliate panel).
Possible Workarounds:
System-generated Volume Shadow Copies (uncommon): vssadmin list shadows → mount last clean snapshot; CTS* deliberately deletes but sometimes fails on slow drives.
Emsisoft “Decrypter CTS* (beta)” (only Ver ≤ 2023-06-05v1/v2, RSA keys already leaked). Tool auto-detects version when victim uploads ransom.txt to their portal.
Offline Backup Rescue Complexity: If backups are immutable-objects without API keys, initiate S3 CLI aws s3 cp s3://mybucket/immutable/ to a fresh subnet—CTS only scans private-range (RFC 1918).

4. Other Critical Information

Unique Differentiators:
Encryption Loop Pass-Through: CTS encrypts twice—first pass flips random 16-byte blocks (deceptive), second pass real encryption. Tools such as Zirrhon-vArif (GitHub) can still recover partial file types (.pdf/.docx) by reconstructing encrypted header templates.
Self-Decoding MSI: requires target x86 vs x64 difference—a 32-bit MSI on 64-bit host falls back to WOW emulation, skipping AV hooks.
Dark-web Portal Theme: “Desert Cactus”; chat support is unusually fluent, sometimes provides corporate TTP maps before negotiation.
Broader Impact:
Hitting German manufacturing and U.S. petroleum at the same time suggests IAB (initial-access-broker) marketplace overlap with the now-defunct Hive network.
CISA alert AA23-170A (28 June 2023) attributes 20 % of 2023 H1 industrial-sector extortions to CTS* affiliates.
Cherished backup appliances (Arcserve 9000, Veeam 11.0 < HF4) are zero-dayd by a java-agent injector (“agent.jar.cts”)—patch immediately.

Resource Matrix

Knowledge shared = power reclaimed. Stay patched, stay backed-up, and do not negotiate.

cts*

Ransomware Profile: CTS* (aka “Cactus”)