Threat Group Profile
arcusmedia
● Active — last 30 days
Victim claims
6
First seen
Jul 2026
Last activity
13 Jul 2026
Tracked since
—
Group overview
Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting process, claiming 50+ victims across manufacturing, healthcare, retail, and business services globally.
Preferred targets
Consumer Services · 1
Hospitality and Tourism · 1
Transportation/Logistics · 1
Technology · 1
Most targeted countries
NG · 1
ZA · 1
FR · 1
PT · 1
MY · 1
CA · 1
