Cactus
From extortion.wiki, the ransomware notes archive
6 archived notes associated with the upstream family directory cactus. The family label follows ThreatLabz; any link to negotiation records uses an explicit archive alias mapping.
Archived note files
6 supported · 0 skipped| Original filename | File type | Content hash | Source | Internal archive |
|---|---|---|---|---|
| cAcTuS.readme_2.txt | Plain text (.txt) | d145fcede2ca5350… | Upstream file | Read archived source |
| cAcTuS.readme_3.txt | Plain text (.txt) | 809ef3e5d21c9490… | Upstream file | Read archived source |
| cAcTuS.readme_4.txt | Plain text (.txt) | 80cd953d2a61d6fc… | Upstream file | Read archived source |
| cAcTuS.readme_5.txt | Plain text (.txt) | 5a712e3505867791… | Upstream file | Read archived source |
| cAcTuS.readme_6.txt | Plain text (.txt) | cd0dc57ddfa9c637… | Upstream file | Read archived source |
| cAcTuS.readme.txt | Plain text (.txt) | 02b07c5624cd9c9a… | Upstream file | Read archived source |
Dataset provenance and citation
| Upstream collector | Zscaler ThreatLabz |
|---|---|
| Source repository | ThreatLabz/ransomware_notes |
| Source directory | cactus |
| Snapshot commit | 2bbf5b4ecda84837c4a71af1a99c6821920f051a |
| Dataset snapshot | Jun 26, 2026, 10:27 PM |
| Synchronization time | Jul 22, 2026, 11:47 AM |
| Source status | Complete |
| License | MIT; preserved notice |
| Stable internal citation | extortion.wiki. Cactus ransomware notes. ThreatLabz/ransomware_notes snapshot 2bbf5b4ecda84837c4a71af1a99c6821920f051a. https://extortion.wiki/notes/cactus/. |