Skip to content
brandefense.io
Request A Demo
RansomwareFinancialSmall team

Sabbath

Sabbath is a ransomware group with a financial motive, tracked by Brandefense. It targets the Diplomacy sector.

Also known as
  • UNC2190
  • 54BB47h
  • Arcane
  • Eruption
Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
Last seen
Oct 31, 2021
Record updated

Who They Target.

Sectors · 1
Labelsransomware

About Sabbath.

Sabbath (also known as 54BB47h, operated by UNC2190) is a ransomware group active from mid-2021 that emerged as a rebrand of the Arcane ransomware, targeting critical infrastructure in the US and Canada, particularly hospitals, schools, and natural resources, using double extortion, backup destruction, and affiliate recruitment on Russian-language dark web forums.

Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.