CACTUSPAL

A ransomware intrusion cluster associated with Cactus deployments. Public incident reporting describes operators using spam flooding and impersonated IT-support calls to obtain remote access, with tradecraft overlapping actors that previously delivered Black Basta.