Ransomware group
Arcusmedia ransomware: victims and leak site activity
The Arcusmedia ransomware group has listed 109 victims on its leak site since May 2024; its latest post is from 24 August 2026. Most affected countries: Brazil, United States and Spain. Most targeted sector: Professional Services.
Total posts
109
First seen
2024-05-15
Latest post
2026-08-24
Countries hit
39
About Arcusmedia
Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting process, claiming 50+ victims across manufacturing, healthcare, retail, and business services globally.
Most targeted countries
- Brazil 20
- United States 16
- Spain 6
- Colombia 5
- United Arab Emirates 4
- France 4
- United Kingdom 4
- Italy 4
- Mexico 3
- South Africa 3
Most targeted sectors
- Professional Services 28
- Technology 24
- Manufacturing 12
- Transportation 9
- Retail & E-Commerce 8
- Agriculture and Food Production 6
- Healthcare 4
- Education 3
- Government & Defense 3
- Hospitality 3