OmniVision disclosed a data breach after the 2023 Cactus ransomware attack

OmniVision disclosed a data breach following a September 2023 intrusion by the Cactus ransomware group that encrypted systems and exfiltrated personal and corporate documents (including passport images, NDAs, and contracts); the extortion gang published proof and ultimately released the stolen data. The report details the group's TTPs—use of legitimate remote access tools (Splashtop, AnyDesk, SuperOps RMM), Cobalt Strike, Chisel, PowerShell-based discovery and deployment scripts, antivirus removal via batch scripts, and Rclone for exfiltration—and notes mitigation steps taken by OmniVision (increased monitoring, cloud migrations, policy updates, and credit monitoring for affected individuals).