Arkana is a ransomware group from early 2025 targeting telecom providers with a three-phase extortion model.
Arkana is a ransomware group that emerged in early 2025, primarily targeting telecom and internet service providers like WideOpenWest (WOW!). They operate a three-phase extortion model involving ransom, sale, and leak of stolen data. Defenders should prioritize monitoring for data exfiltration and encryption events within telecom infrastructure, focusing on this sector-specific TTP.
Arkana is a ransomware group that emerged in early 2025 and gained attention by claiming an attack on U.S. broadband provider WideOpenWest (WOW!), operating a three-phase ransom/sale/leak extortion model primarily focused on telecom and internet service providers.
Primarily the telecommunications sector, especially broadband internet service providers like 'WOW!'.
A three-phase extortion model: ransom demand, sale of data, and leaking.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.