Ransomware group
Arcusmedia ransomware: victims and leak site activity
The Arcusmedia ransomware group has listed 118 victims on its leak site since May 2024; its latest post is from 9 October 2026. Most affected countries: Brazil, United States and Spain. Most targeted sector: Professional Services.
Total posts
118
First seen
2024-05-15
Latest post
2026-10-09
Countries hit
41
About Arcusmedia
Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting process, claiming 50+ victims across manufacturing, healthcare, retail, and business services globally.
- Leak site (Tor)
- http://arcuufpr5xxbbkin4mlidt7itmr6znlppk63jbtkeguuhszmc5g7qdyd.onion
- Profile
- ransomware.live
Most targeted countries
- Brazil 23
- United States 16
- Spain 6
- Colombia 5
- United Arab Emirates 4
- Canada 4
- France 4
- United Kingdom 4
- Italy 4
- Mexico 4
Most targeted sectors
- Professional Services 28
- Technology 25
- Manufacturing 14
- Transportation 9
- Agriculture and Food Production 8
- Retail & E-Commerce 8
- Government & Defense 4
- Healthcare 4
- Education 3
- Hospitality 3