Arcus Media — Ransomware Profile
Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting process, claiming 50+ victims across manufacturing, healthcare, retail, and business services globally.Also tracked as
Arcusmedia
Tools & malware
- Arcus Media Encryptor Ransomware
- Mimikatz Credential Access
Recent claimed victims
- Ladrillera Mecanizada 2026-10-09
- mblllp 2026-10-09
- AETHOS 2026-10-09
- Pantaneiro Capas 2026-09-27
- AGROFRUTO SAC 2026-09-23
- AKAZZO 2026-09-19
- Schneider’s Computing 2026-09-19
- ARDA 2026-09-16
- Asada Sarapiqu 2026-09-15
- Mark’Techno 2026-08-24
- ManagementPro 2026-08-24
- Brazer Ingenierie 2026-07-26
- Power Moendas 2026-07-26
- I-FITNESS 2026-07-14
- Perpustam 2026-07-14
- Distribox 2026-07-14
- gemese.pt 2026-07-14
- COREBI(NowVertical) 2026-07-14
- Be Travel 2026-07-14
- East African Gasoil 2026-07-06
Vendor research
- Arcus Media Ransomware (Protection Bulletin, 12 November 2024) Symantec (Broadcom)
- O Brasil na mira do Arcus Media Ransomware ISH Tecnologia (Heimdall Security Research)
- Emerging Threat Actor: Arcus Media Ransomware Halcyon
- Weekly Intelligence Report - 26 July 2024 CYFIRMA
- Arcus Media Ransomware Displays Novel Process Targeting, Selective Encryption and Recovery Disruption Halcyon