Sabbath
| RaaS
Sabbath (also known as 54BB47h, operated by UNC2190) is a ransomware group active from mid-2021 that emerged as a rebrand of the Arcane ransomware, targeting critical infrastructure in the US and Canada — particularly hospitals, schools, and natural resources — using double extortion, backup destruction, and affiliate recruitment on Russian-language dark web forums.
Victims
17
First Discovered
2021-11-22
victim
Last Discovered
2022-02-28
victim
Inactive Since
4yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
N/A
victims with domain
Countries
0
hit
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
BLOG | No | 2026-04-28T07:26:20 |
54bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd.onion
|
|||
|
No | 2026-04-28T07:28:52 |
54bb47h.blog
|
Target
Top 5 Activity Sectors
- Education 3
- Technology 3
- Business Services 2
- Agriculture and Food Production 1
- Consumer Services 1
Top 5 Countries
Heatmap
YARA Rules (1)
Victims (17)
