Arcus Media is a relatively new group. Your first victim appeared on your site on May 8th. Is Arcus Media a brand new group or a rebrand of an old group?

Arcus is a new group, but we have affiliates from other groups too. We are not developers offering our programs; as hackers, we offer techniques and exploits. Affiliates who have problems in an attack can use other affiliates for a percentage they decide.

Do your tactics include double extortion—encryption and data leak—or just data leak?

Extortion — encryption.

One of your recent victims was FILSCAP, a non-profit organization representing music creators in the Philippines. How do you select your targets? Are there any red lines?

It's the affiliate's choice; we don't limit them to anything.

Why did you start your ransomware operation? Why not work in a regular job in the cybersecurity field? Do you do this only for the money, or do you have other motives?

Regular jobs don't have challenges, fun, and money.

I assume you've heard about Operation Cronos. Also, just yesterday, we learned about the arrest of a Scattered Spider group member. Aren't you concerned about being apprehended by law enforcement?

OPSEC is important; we give affiliates advice and resources to stay safe.

What is the most common vector you use to breach organizations? Do you exploit those vectors yourself, or do you buy access from access brokers?

It's the affiliate's choice; we don't limit them to anything.

How do you establish trust with your team members and affiliates? Have you conducted any tests or implemented specific measures to build and maintain trust?

Access is limited even to highly trusted people. Any changes in our operations or any strange requests without other administrative approval will be blocked automatically.

On the other hand, how can affiliates trust you? We all saw what happened with ALPHV when one of their affiliates accused them of stealing $20 million from their share.

They have full control over chats. Highly trusted members can use their own wallets and then pay our part.

Before publishing the ransom note, how long do you stay inside the victim's network?

Can't explain that.

In the Conti Leaks chats, we discovered they had a massive operation with different departments. Do you work with a similar model?

Can't explain that.

You've published 18 victims on your data leak site so far. Out of all your victims, can you share the percentage that have paid the ransom versus those who have not?

Can't explain that. Smart ones pay.

Do any of you have families? How do you explain your work to them, and are they aware of what you do?

OPSEC is important even in real life.

How much time and money do you dedicate to developing and maintaining your operation?

A few years for gaining enough experience.

Any recommendations for companies on how to defend themselves against ransomware attacks?

There is no defense; everything can be bypassed. Paying ransom is the fastest and smartest way.

Would you use services from a company that you breached in the past?

No.

Any last message to the CyberSecurityIL community?

White hats don't have the guts to be black hats.