ToyMaker Uses LAGTOY to Sell Access to CACTUS Ransomware Gangs for Double Extortion

ToyMaker Partners with LAGTOY to Facilitate Access to CACTUS Ransomware Gangs for Double Extortion Schemes - Market-News24

Cybersecurity experts have identified an initial access broker called ToyMaker, which is linked to double extortion ransomware groups, including CACTUS. ToyMaker uses custom malware known as LAGTOY to gain access to vulnerable systems, allowing it to create reverse shells and execute commands remotely. Initially documented by Mandiant in early 2023, ToyMaker targets high-value organizations by ...

ToyMaker Uses LAGTOY To Sell Access To CACTUS Ransomware Gangs For Double Extortion - Cybernoz - Cybersecurity News

Apr 26, 2025Ravie LakshmananMalware / Vulnerability Cybersecurity researchers have detailed the activities of an initial access broker (IAB) dubbed ToyMaker that has been observed handing over access to double extortion ransomware gangs like CACTUS. The IAB has been assessed with medium confidence to be a financially motivated threat actor, scanning for vulnerable systems and deploying a custom malware called LAGTOY (aka HOLERUN). “LAGTOY can…

ToyMaker Uses LAGTOY to Sell Access to CACTUS Ransomware Gangs for Double Extortion

Cybersecurity researchers have detailed the activities of an initial access broker (IAB) dubbed ToyMaker that has been observed handing over access to double extortion ransomware gangs like CACTUS. The IAB has been assessed with medium confidence to be a financially motivated threat actor, scanning for vulnerable systems and deploying a custom malware called LAGTOY (aka HOLERUN). "LAGTOY can be