Arkana
Arkana is a ransomware threat actor first listed as a new ransomware variant appearing in March 2024. Reporting cited in the provided content says Arkana claimed victims including WideOpenWest, Oregon Surveillance, INFINOX Global, Anglo American, Synopsys, and Ticketmaster. Separate reporting states Arkana targeted high-value global brands in the entertainment sector. Microsoft Threat Intelligence reportedly identified Arkana as part of Qilin’s affiliate roster, alongside groups such as Octo Tempest/Scattered Spider and Devman. Additional reporting says that when Arkana launched a data extortion site in March 2025, its about page displayed a “Qilin Network” logo, suggesting a working relationship with Qilin. Based on the provided content, Arkana is therefore associated with ransomware and data extortion activity and appears linked to the Qilin ransomware ecosystem as an affiliate or partner. No higher-confidence attribution to a nation state is provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Reported Qilin affiliate named in the affiliate roster.
Named as a new ransomware variant/gang emerging in 2024 and associated with victim claims posted in March 2024.
Ransomware actor targeting high-value global entertainment brands to maximize leverage and reputational damage.
Ransomware actor listed as active in Q1 2025 targeting industrial sectors.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.