arcus media
ransomware group · aka ArcusLocker, Actier · unknown · active since 2019 (earliest public activity; Rapid7, 2023)
Arcus Media is a ransomware and data-extortion group first documented in 2019, best known for the Nim-based ArcusLocker encryptor for Windows and a later variant tracked as Actier (Rapid7, 2023). Public reporting describes slow, methodical operations with long dwell times, initial access via vulnerable or exposed RDP — at times through Veeam backup servers — and abuse of the legitimate ITarian RMM tool for remote access and persistence. The group runs a leak site used for double-extortion pressure; this dashboard tracked 11 leak-site victims since 2026-07-06, with 2 posts in the last 30 days and the latest post on 2026-08-24. Publicly listed victims span multiple countries and industries, including IT services, engineering, manufacturing, energy, and travel. Attribution, national origin, and earnings are not publicly reported.
- Initial access via vulnerable or exposed RDP
- Use of Veeam backup infrastructure as an access vector (per Rapid7, 2023)
- Abuse of legitimate ITarian RMM tool as a backdoor/remote-access channel
- Deployment of Nim-based Windows ransomware (ArcusLocker)
- Use of the Actier ransomware variant
- Data exfiltration combined with leak-site posting for double extortion
- Long dwell time and slow-paced operations ('lazy' operator behavior per Rapid7, 2023)
ManagementPro, Mark'Techno, Brazer Ingenierie, Power Moendas, Perpustam, gemese.pt, Distribox, Be Travel, COREBI (NowVertical), I-FITNESS
No public figure.
Leak-site victims112 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Immediate Transport – UK | · Jun 4, 2024 | Immediatetransport.comImmediate Transportation Co. is a privately... |
| Colégio Nova Dimensão | · May 18, 2024 | colegiond.com.br The world has changed and... |
| RIO TECHNOLOGY | · May 16, 2024 | Riotechnology.com.co Riotechnology, experts in software, hardware... |
| Egyptian Sudanese | · May 16, 2024 | Egyptiansudanese.com The Egyptian Sudanese company was... |
| BRAZIL GOV | · May 15, 2024 | Santoantoniodapatrulha.rs.gov.br : City Hall of Santo... |
| Braz Assessoria Contábil | · May 15, 2024 | Brazcontabil.com.brBraz Assessoria Contábil is a company... |
| Thibabem Atacadista | · May 15, 2024 | Thibabem.com.br Thibabem Atacadista e Distribuidor operates... |
| FILSCAP | · May 15, 2024 | Filscap.com.ph : Filipino Society of Composers,... |
| Cusat | · May 15, 2024 | Cusat.com.ar Cusat develop and operate Geo-Location... |
| Frigrífico Boa Carne | · May 15, 2024 | Frigboacarne.com.br The BOA CARNE Refrigerator was... |
| GOLD RH S.A.S | · May 15, 2024 | Goldrh.com.coGold RH is a company with... |
| Grupo SASMET | · May 15, 2024 | Grupo SASMET is a company that... |
In the newsAll →
No articles mention this group yet.