THREAT ACTOR
ARCUS-MEDIA_
DormantARCUS-MEDIA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of ARCUS-MEDIA, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 15
- 2025 41
- 2024 59
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
arcuufpr5xxbbkin4mlidt7itmr6znlppk63jbtkeguuhszmc5g7qdyd.onionA r c u s snapshot · 2026-09-23 03:35
Recent victims
The 50 most recent victims claimed by ARCUS-MEDIA. Total in the index: 115.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-19 | Schneider’s Computing | |
| 2026-09-19 | AKAZZO | |
| 2026-09-16 | ARDA | |
| 2026-09-15 | Asada Sarapiqu | |
| 2026-08-24 | ManagementPro | |
| 2026-08-24 | Mark’Techno | |
| 2026-07-25 | Brazer Ingenierie | |
| 2026-07-25 | Power Moendas | |
| 2026-07-14 | Perpustam | |
| 2026-07-14 | gemese.pt | |
| 2026-07-14 | Distribox | |
| 2026-07-14 | Be Travel | |
| 2026-07-14 | COREBI(NowVertical) | |
| 2026-07-14 | I-FITNESS | |
| 2026-07-06 | East African Gasoil | |
| 2025-09-17 | Announcement 16-09-2025 | Hey , We have been offline for weeks .we taught it is time to rebrand … |
| 2025-09-17 | Grup Gestio | Days00006666Hours22222222Minutes22225555Seconds22228888 grupgestio.n… |
| 2025-09-17 | Tunad | Days00006666Hours22222222Minutes22225555Seconds22228888 Tunad.io Tun… |
| 2025-09-17 | Accflex ERP | Days00006666Hours22222222Minutes22225555Seconds22228888 www.accflex.… |
| 2025-08-13 | EB Farmacutica | Days00006666Hours22223333Minutes00000000Seconds44447878 ebfarmaceuti… |
| 2025-07-28 | CCI Torrevieja | Days00006666Hours22223333Minutes00007777Seconds00004444 ccitorreviej… |
| 2025-07-28 | College stjb | Days00006666Hours22223333Minutes00007777Seconds00004444 stjb-delasal… |
| 2025-07-26 | I.P. One LTD | Days00006666Hours22223333Minutes22222222Seconds11114444 I.P. One was… |
| 2025-07-22 | Protech Medical | Days00006666Hours22221111Minutes22227777Seconds22228888 www.protechm… |
| 2025-07-22 | SubsCorp | Days00006666Hours22221111Minutes22227777Seconds22228888 Subs Corp S.… |
| 2025-07-05 | Assetlabs | Days00006666Hours22223333Minutes33333333Seconds00003333 assetlabs.co… |
| 2025-07-05 | BD Group | Days00006666Hours22223333Minutes33333333Seconds00003333 bdgroup.com.… |
| 2025-07-05 | RG Mexico | Days00006666Hours22223333Minutes33333333Seconds00003333 rgmexico.com… |
| 2025-05-30 | STANDBYTE | Days00006666Hours22223333Minutes00004444Seconds44440101 standbyte.co… |
| 2025-05-30 | Acorn Sales | Days00006666Hours22223333Minutes00004444Seconds44440101 www.acornsal… |
| 2025-05-26 | Antea Luce | Days00006666Hours22223333Minutes55550000Seconds11112222 www.antealuc… |
| 2025-05-18 | Colegio de la Compania de Maria Vigo | Days00006666Hours22223333Minutes44444444Seconds55550101 ciamariavigo… |
| 2025-05-18 | Fong Shann Printing Philippines | Days00006666Hours22223333Minutes44444444Seconds55550101 fongshann.co… |
| 2025-05-18 | Road Development Corporation | Days00006666Hours22223333Minutes44444444Seconds55550101 www.rdc.com.… |
| 2025-05-18 | RECI SYSTEMS | Days00006666Hours22223333Minutes44444444Seconds55550101 www.recisyst… |
| 2025-05-18 | Grupo Boulevard | Days00006666Hours22223333Minutes44444444Seconds55550101 grupobouleva… |
| 2025-03-19 | Coopertruni | Days00006666Hours11117777Minutes44440000Seconds55559999 www.coopertr… |
| 2025-03-19 | THX Transport | Days00006666Hours11117777Minutes44440000Seconds55559999 www.thxtrans… |
| 2025-03-19 | Kiribati Government | Days00006666Hours11117777Minutes44440000Seconds55559999 Kao.gov.ki t… |
| 2025-03-12 | HYPONAMIRU | Days00006666Hours22223333Minutes00002222Seconds22225656 www.hyponami… |
| 2025-03-12 | HYPERNOVA TELECOM | Days00006666Hours22223333Minutes00002222Seconds22225656 www.hypernov… |
| 2025-03-08 | REYCOTEL | Days00006666Hours22222222Minutes55559999Seconds33330000 reycotel.com… |
| 2025-03-04 | LINKGROUP | Days00007777Hours00009999Minutes44447777Seconds22227878 linkgroup.co… |
| 2025-03-04 | Openreso | Days00007777Hours00009999Minutes44447777Seconds22227878 openreso.com… |
| 2025-03-04 | Itapeseg | Days00007777Hours00009999Minutes44447777Seconds22227878 itapeseg.com… |
| 2025-03-04 | logic insectes | Days00007777Hours00009999Minutes44447777Seconds22227878 logicinsecte… |
| 2025-03-04 | RJ IT Solutions | Days00007777Hours00009999Minutes44447777Seconds22227878 RJ IT Soluti… |
| 2025-03-04 | Grafitec | Days00007777Hours00009999Minutes44447777Seconds22227878 grafitec.co.… |
| 2025-03-04 | synaptic.co.tz | Days00007777Hours00009999Minutes44447777Seconds22227878 synaptic.co.… |
| 2025-03-04 | ICO | Days00007777Hours00009999Minutes44447777Seconds22227878 ico.com.br S… |
CONFIRMED ATTACKS
Arcus Media confirmed attacks: 2 verified incidents
Ransomnews has verified 2 Arcus Media incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from September 2024 to July 2026. South Africa accounts for 1 of them (50%), with victims recorded in 2 countries in total. The most affected sector is service, at 1 confirmed victim. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 1.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Arcus Media incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | Baithaupi Executive Travel | Service | Johannesburg, South Africa | — | No | Source |
| September 2024 | Rextech | Technology | Odense, Denmark | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Arcus Media's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.