arcusmedia
Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting process, claiming 50+ victims across manufacturing, healthcare, retail, and business services globally.
observed victims (by country)
BrazilMoroccoNigeriaSouth Africa
observed sectors
TechnologyProfessional ServicesOtherManufacturing
10 victims · last active 24 Aug 2026
recent activity · our intel
source: ransomware.live1 refs →