sabbath
Activity analysis
HackerFeeds has tracked 17 victims claimed by sabbath since November 2021, most recently in February 2022 — ranking #182 of 332 groups (0.1% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in February 2022. Its most-targeted sector is Technology (3 victims), followed by Education (3).
Victims per year
- 202110
- 20227
Top sectors
- Technology3
- Education3
- Business Services2
- Manufacturing1
- Consumer Services1
- Agriculture and Food Production1
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
Sabbath (also known as 54BB47h, operated by UNC2190) is a ransomware group active from mid-2021 that emerged as a rebrand of the Arcane ransomware, targeting critical infrastructure in the US and Canada — particularly hospitals, schools, and natural resources — using double extortion, backup destruction, and affiliate recruitment on Russian-language dark web forums.
Recent victims
No victims tracked yet.