arcus media
Active9 claimed victims
The claims below are reproduced as posted by arcus media on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Arcus Media first emerged in May 2024 and operates as a Ransomware-as-a-Service (RaaS) with a double-extortion model—encrypting data and threatening to leak it if the ransom isn't paid. The group leverages advanced capabilities including selective encryption (partial encryption of large files with the ChaCha20 cipher and RSA‑2048 key protection), privilege escalation, disabling recovery mechanisms, and terminating critical services like SQL servers and email clients to maximize disruption and thwart defense.
Description from RansomLook (CC BY 4.0).
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Ladrillera Mecanizada | October 9, 2026 | ransomlook | — |
| mblllp | October 9, 2026 | ransomlook | — |
| AETHOS | October 9, 2026 | ransomlook | — |
| Pantaneiro Capas | September 27, 2026 | ransomlook | — |
| AGROFRUTO SAC | September 23, 2026 | ransomlook | — |
| AKAZZO | September 19, 2026 | ransomlook | — |
| Schneider’s Computing | September 19, 2026 | ransomlook | — |
| ARDA | September 16, 2026 | ransomlook | — |
| Asada Sarapiqu | September 15, 2026 | ransomlook | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).