sarcoma ransomware group
Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.
- Claims in 7 days
- 0
- Claims in 30 days
- 2
- Reported techniques
- 19
Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.
Where it claims victims
| Country | Claims in 60 days |
|---|---|
| Philippines | 1 |
Sectors
| Sector | Claims in 60 days |
|---|---|
| Retail & E-Commerce | 1 |
| Professional Services | 1 |
Reported techniques
Valid AccountsExploit Public-Facing ApplicationTrusted RelationshipPhishingScheduled Task/JobObfuscated Files or InformationOS Credential DumpingRemote System DiscoveryFile and Directory DiscoverySystem Location DiscoveryRemote ServicesArchive Collected DataExfiltration Over Web ServiceRemote Access ToolsData Encrypted for ImpactService StopInhibit System RecoveryModify RegistryDisable or Modify Tools