Arcusmedia

Active
Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting process, claiming 50+ victims across manufacturing, healthcare, retail, and business services globally.
111 Victims
May 7, 2024 First Discovered
Sep 16, 2026 Last Discovered
0 Days Inactive
0% Infostealer
1/1 Sites Online
Known Locations (1)
A r c u s
arcuufpr5xxbbkin4mlidt7itmr6znlppk63jbtkeguuhszmc5g7qdyd.onion
Victims (111)

Detailed victim list temporarily unavailable

This group has 111 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.