ZeroHour

arcus media

ransomware group · aka ArcusLocker, Actier · unknown · active since 2019 (earliest public activity; Rapid7, 2023)

Victims · 7d
1▲1 vs prev. week
Victims · 30d
3active targets
Victims · 90d
12
All-time (tracked)
112since 2024-05-15
Last post
09-15 17:37UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

Arcus Media is a ransomware and data-extortion group first documented in 2019, best known for the Nim-based ArcusLocker encryptor for Windows and a later variant tracked as Actier (Rapid7, 2023). Public reporting describes slow, methodical operations with long dwell times, initial access via vulnerable or exposed RDP — at times through Veeam backup servers — and abuse of the legitimate ITarian RMM tool for remote access and persistence. The group runs a leak site used for double-extortion pressure; this dashboard tracked 11 leak-site victims since 2026-07-06, with 2 posts in the last 30 days and the latest post on 2026-08-24. Publicly listed victims span multiple countries and industries, including IT services, engineering, manufacturing, energy, and travel. Attribution, national origin, and earnings are not publicly reported.

Tactics & tooling
  • Initial access via vulnerable or exposed RDP
  • Use of Veeam backup infrastructure as an access vector (per Rapid7, 2023)
  • Abuse of legitimate ITarian RMM tool as a backdoor/remote-access channel
  • Deployment of Nim-based Windows ransomware (ArcusLocker)
  • Use of the Actier ransomware variant
  • Data exfiltration combined with leak-site posting for double extortion
  • Long dwell time and slow-paced operations ('lazy' operator behavior per Rapid7, 2023)
Targeted sectors
IT services/softwareengineeringmanufacturingenergytraveldistribution
Notable public victims

ManagementPro, Mark'Techno, Brazer Ingenierie, Power Moendas, Perpustam, gemese.pt, Distribox, Be Travel, COREBI (NowVertical), I-FITNESS

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
Immediate Transport – UK · Jun 4, 2024Immediatetransport.comImmediate Transportation Co. is a privately...
Colégio Nova Dimensão · May 18, 2024colegiond.com.br The world has changed and...
RIO TECHNOLOGY · May 16, 2024Riotechnology.com.co Riotechnology, experts in software, hardware...
Egyptian Sudanese · May 16, 2024Egyptiansudanese.com The Egyptian Sudanese company was...
BRAZIL GOV · May 15, 2024Santoantoniodapatrulha.rs.gov.br : City Hall of Santo...
Braz Assessoria Contábil · May 15, 2024Brazcontabil.com.brBraz Assessoria Contábil is a company...
Thibabem Atacadista · May 15, 2024Thibabem.com.br Thibabem Atacadista e Distribuidor operates...
FILSCAP · May 15, 2024Filscap.com.ph : Filipino Society of Composers,...
Cusat · May 15, 2024Cusat.com.ar Cusat develop and operate Geo-Location...
Frigrífico Boa Carne · May 15, 2024Frigboacarne.com.br The BOA CARNE Refrigerator was...
GOLD RH S.A.S · May 15, 2024Goldrh.com.coGold RH is a company with...
Grupo SASMET · May 15, 2024Grupo SASMET is a company that...

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .