Correct! That's the way I learnt it. But Dr. Phil @Philip should be the authority here and in order to avoid his usual pomposity (kidding kidding!), he abdicated!
Actually according to the "Grammar Police", both answers are correct but technically "whom" is better but no-one says it that way.
Technically, that "whom" is correct because it's the object of the verb. Yet almost no one would say it that way. Does that mean everyone's wrong? No. It means that, when the pronoun's at the beginning of a sentence, even the most formal writing can use "who" as an object.
So the OP should have said, "Whom is to blame?" wtf?