Arcus Media — Ransomware Profile
Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting process, claiming 50+ victims across manufacturing, healthcare, retail, and business services globally.Also tracked as
Arcusmedia
Recent claimed victims
- Brazer Ingenierie 2026-07-26
- Power Moendas 2026-07-26
- Distribox 2026-07-14
- gemese.pt 2026-07-14
- COREBI(NowVertical) 2026-07-14
- Be Travel 2026-07-14
- I-FITNESS 2026-07-14
- Perpustam 2026-07-14
- East African Gasoil 2026-07-06
Vendor research
- O Brasil na mira do Arcus Media Ransomware ISH Tecnologia (Heimdall Security Research)
- Arcus Media Ransomware Displays Novel Process Targeting, Selective Encryption and Recovery Disruption Halcyon
- Emerging Threat Actor: Arcus Media Ransomware Halcyon
- Weekly Intelligence Report - 26 July 2024 CYFIRMA