Who is to blame?

I think I should use "whom is to blame" but I don't know.

In speech I'd probably say "who's to blame?" implying "who is" but that just doesn't sound quite right to me.

Whom is to blame? is wrong, from what I can tell.

Whom is a pronoun that may only serve as the object in a sentence (be it affirmative or interrogative), and as such it cannot be used in a sentence where no subject is stated, or at the very least, implied. Your question should read:

Whom are we to blame?

or

Whom should we blame?

(we, in both cases, being the subject).

As deadrat has noted in his comment below, whom may very well appear in an imperative clause, where the subject is not explicitly stated, but rather implied, such as:

Blame whom you like.

As for your instinctive choice Who is to blame, the issue here is not the opening question word, but the voice of the infinitive ("to blame"), 'cause whoever he/she is, Mr. Who is not the one blaming but the one being blamed, so if one prioritized semantical transparency, as Janus Bahs Jacquet puts it, the question should read:

Who is to be blamed?

Who is to blame? is not, however, wrong. It's merely idiomatic.

To blame has virtually come to serve as a synonym for "blameable" (see Janus Bahs Jacquet's comment for a more refined description), while the subject of the infinitive (i.e. those blaming), is left to the realm of the implicit, so to speak, and thus rid of its significance.

Yet another alternative, almost identical to the last one, but less confusing perhaps, is:

Who is there to blame?

Addendum: Thanks to both aforementioned members for their constructive criticism of my initial answer.

The correct choice would be,

Who is to blame?

The word who is the subject of the verb, not the object. In fact, the verb to be is a linking verb, as are all forms of to be, meaning that they don't take objects, but rather re-describe the subject with a subject complement.

When it comes to linking verbs, you should always use who, not whom. But with an action verb, like hit, it would be correct to use whom. For example,

Whom did Alex hit with the rock?

Here, the subject of the verb is Alex, and whom is the object. This a correct use of whom.