sarcoma Ransomware
Tracked since Oct 9, 2024
1
victims recorded
1
in the last 30 days
0
CVEs
2d
Last activity
Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1566 PhishingT1566.001 Phishing: Spearphishing Attachment Persistence
T1053 Scheduled Task/JobT1053.003 Scheduled Task/Job: Cron Defense Evasion
T1027 Obfuscated Files or InformationT1112 Modify RegistryT1562 Impair DefensesT1562.001 Impair Defenses: Disable or Modify Tools Credential Access
T1003 OS Credential Dumping Discovery
T1018 Remote System DiscoveryT1083 File and Directory DiscoveryT1614 System Location DiscoveryT1614.001 System Location Discovery: System Language Discovery Lateral Movement
T1021 Remote Services Collection
T1560 Archive Collected Data Exfiltration
T1567 Exfiltration Over Web Service Command and Control
T1219 Remote Access Tools Impact
T1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System Recovery Observed tools
Discovery Enum
Advanced IP Scanner
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live