Group profile4 claimed in last 30d11 total tracked

arcusmedia

Forward this

Arcus Media has posted victims in short, scattered bursts since mid-July 2026, with a claimed count of nine sitting well below the 50-plus figure the group asserts for itself since its May 2024 emergence. Recent activity spans manufacturing, technology, transportation/logistics, and hospitality targets across a wide geographic spread, including Morocco, Brazil, Malaysia, Portugal, France, South Africa, and Canada, suggesting opportunistic rather than sector-focused targeting. The group operates a ransomware-as-a-service model and is described as vetting affiliates through a referral process, with double extortion (data theft paired with encryption) as its stated leverage method; its listed toolkit combines ChaCha20 for bulk file encryption with RSA-2048 for key protection. No confirmed MITRE ATT&CK technique catalogue is publicly attributed to this group at present, so specific intrusion or evasion behavior beyond the claimed encryption scheme cannot be verified. The pace of claims over the tracked window remains low volume, two victims

Brief by The Nexus · Aug 15 · 15:07 UTC

Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting process, claiming 50+ victims across manufacturing, healthcare, retail, and business services globally.

First seen: Jul 13 · 16:43 UTCLast seen: Aug 24 · 13:58 UTCTracked since: 2024-05-15

Sectors hit

Technology3
Unspecified2
Transportation/Logistics1
Professional Services1
Other1
Manufacturing1
Hospitality and Tourism1
Consumer Services1

Countries hit

Canada2
South Africa1
Portugal1
Nigeria1
Malaysia1
Morocco1
France1
Brazil1

Recent claimed victims

Professional ServicesAug 24 · 14:24 UTC

ManagementPro

mproerp.com

Source ↗

TechnologyAug 24 · 14:23 UTC

Mark’Techno

marcktechno.com

Source ↗

ManufacturingMoroccoJul 26 · 10:02 UTC

Brazer Ingenierie

brazeringenierie.com

Source ↗

OtherBrazilJul 26 · 10:02 UTC

Power Moendas

powermoendas.com.br

Source ↗

MalaysiaJul 14 · 20:12 UTC

Perpustam

Perpustam.gov.my

Source ↗

PortugalJul 14 · 20:12 UTC

gemese.pt

Source ↗

Transportation/LogisticsFranceJul 14 · 20:11 UTC

Distribox

distribox.fr

Source ↗

Hospitality and TourismSouth AfricaJul 14 · 20:11 UTC

Be Travel

betravel.co.zaCovered · ABC7 Chicago →Scammers pretending to be travel agents to access customer booking information

Source ↗

TechnologyCanadaJul 14 · 20:10 UTC

COREBI(NowVertical)

Source ↗

TechnologyCanadaJul 14 · 20:10 UTC

COREBI(NowVertical)

NowVertical.com

Source ↗

Consumer ServicesNigeriaJul 14 · 20:09 UTC

I-FITNESS

ifitness.ng

Source ↗