CACTUS RANSOMWARE MALWARE ANALYSIS — SHADOWSTACKRE

Summary from the TLDR InfoSec newsletter

The Cactus ransomware has been targeting victims across various industries and putting pressure on them by releasing personal information. The malware uses standard C++ constructs and Windows scheduled tasks for persistence. This analysis provides information on the build of the malware, its program flow, its setup process, and the techniques it uses to inhibit system recovery.