Skip to main content
Darkfield

Operator dossier

arkana is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 6 public victims claimed by this operator between March 25, 2025 and June 6, 2025. Arkana is a relatively new ransomware group that emerged in March 2025, operating with primarily financial motivations based on their targeting patterns and victim selection. Given their recent emergence and limited public documentation, specific details about their country of origin and operational structure remain unclear, though their targeting of US and UK entities suggests sophisticated capabilities and potential ties to established cybercriminal ecosystems. With only six documented victims to date, Arkana appears to follow a selective targeting approach, focusing on high-value sectors including financial services, technology, energy, and consumer services, though their specific initial access vectors, encryption methods, and whether they employ double or triple extortion tactics have not been publicly documented by major threat intelligence organizations. No notable high-profile campaigns or significant law enforcement actions have been reported against this group, likely due to their recent emergence and relatively small victim count. Arkana remains active as of the available intelligence, though their limited operational footprint suggests they are either a newly formed group still developing their capabilities or a highly selective operation focusing on carefully chosen targets.

Most-targeted sectors

Most-affected countries

Recent disclosures by arkana

All 6 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for arkana →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

arkana

6 victims indexed · first seen 1 year ago · last activity 1 year ago

6
Victims indexed
#238 of 364 tracked operators
3m
Active period
Mar 2025 → Jun 2025
2
Countries hit
top US · 4

At a glance

Status
inactive
First seen
1 year ago
Last activity
1 year ago
Onion sites
1 known endpoint
Primary sector
Not Found · 1 hits

About

Arkana is a relatively new ransomware group that emerged in March 2025, operating with primarily financial motivations based on their targeting patterns and victim selection. Given their recent emergence and limited public documentation, specific details about their country of origin and operational structure remain unclear, though their targeting of US and UK entities suggests sophisticated capabilities and potential ties to established cybercriminal ecosystems. With only six documented victims to date, Arkana appears to follow a selective targeting approach, focusing on high-value sectors including financial services, technology, energy, and consumer services, though their specific initial access vectors, encryption methods, and whether they employ double or triple extortion tactics have not been publicly documented by major threat intelligence organizations. No notable high-profile campaigns or significant law enforcement actions have been reported against this group, likely due to their recent emergence and relatively small victim count. Arkana remains active as of the available intelligence, though their limited operational footprint suggests they are either a newly formed group still developing their capabilities or a highly selective operation focusing on carefully chosen targets.

Timeline

3 months
2025-03-01T00:00:00+00:00 · 22025-05-01T00:00:00+00:00 · 22025-06-01T00:00:00+00:00 · 2
2025-03-01T00:00:00+00:002025-06-01T00:00:00+00:00

Top countries

🇺🇸 United States
4
🇬🇧 United Kingdom
2
United States dossier →United Kingdom dossier →

Top sectors

Financial Services
1
Technology
1
Energy
1
Consumer Services
1
Telecommunication
1
Financial Services dossier →Technology dossier →Energy dossier →Consumer Services dossier →

MITRE ATT&CK

4 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://arkanabb66ee4nsdji6la2bu6bwqe3dbtsyf3rxrv6vhiehod7utagad.onion

Source

Updated 1 year ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time arkana posts a victim.

Add arkana to your watchlist — Pro pings you within 5 minutes of any new arkana leak-site post, Telegram callout, or affiliate-rebrand inference.