CyberVolk Arcanum

CyberVolk Arcanum, shortened here to Arcanum, is a CyberVolk-linked identity with direct evidence of external website defacement. A publicly reachable compromised-page artifact displays the text “HACKED BY CYBERVOLK ARCANUM” and promotes contact identifiers tied to the broader CyberVolk ecosystem. This makes the relationship materially stronger than a generic greeting or third-party association.

The identity boundary is not settled. Cyble includes CyberVolkArcanum among CyberVolk identifiers and explicitly frames CyberVolk's many names as manifestations of a decentralized actor ecosystem rather than clearly independent subgroups. Seqrite, by contrast, preserves CyberVolk Arcanum as a separately named hacktivist team in its regional landscape mapping. These taxonomic differences justify maintaining Arcanum as a separate 3C-INT node while linking it strongly to CyberVolk and keeping organizational separateness at only medium confidence.

The direct technical evidence is deliberately narrower than the parent CyberVolk profile. The Arcanum-specific artifact proves unauthorized public-content alteration, but it does not prove use of CyberVolk ransomware, VolkLocker, CyberVolk's stealer/webshell tooling, DDoS infrastructure or RaaS operations. Those capabilities remain CyberVolk-specific unless future Arcanum evidence independently connects them.

A current index for @[redacted] shows the channel under the title Malnox ZeroX with Syria-oriented branding. INFERENCE (confidence: medium): the handle may have been repurposed, transferred, rebranded or absorbed into another identity. This weakens use of the handle as proof of current Arcanum continuity while making it a useful historical/identity-resolution pivot.