Sabbath
| RaaS
Sabbath (also known as 54BB47h, operated by UNC2190) is a ransomware group active from mid-2021 that emerged as a rebrand of the Arcane ransomware, targeting critical infrastructure in the US and Canada — particularly hospitals, schools, and natural resources — using double extortion, backup destruction, and affiliate recruitment on Russian-language dark web forums.
Victims
17
First Victim
2021-11-22
(est. attack date)
Discovery Date
2021-11-22
Last Seen
2022-02-28
Inactive Since
4yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
N/A
victims with domain
Countries
0
hit
Uptime
0.0% avg (30d)
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
BLOG | No | 2026-08-22T08:42:50 |
54bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd.onion
|
||||
|
No | 2026-08-22T08:44:01 |
54bb47h.blog
|
Target
Top 5 Activity Sectors
- Technology 4
- Education 3
- Retail & E-Commerce 2
- Professional Services 2
- Agriculture and Food Production 1
Top 5 Countries
Heatmap
YARA Rules (1)
Victims (17)
