sarcoma

Profile

Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.

Tactics and techniques (MITRE ATT&CK)

Initial Access

T1078 · Valid AccountsT1190 · Exploit Public-Facing ApplicationT1199 · Trusted RelationshipT1566 · PhishingT1566.001 · Phishing: Spearphishing Attachment

Persistence

T1053 · Scheduled Task/JobT1053.003 · Scheduled Task/Job: Cron

Defense Evasion

T1027 · Obfuscated Files or InformationT1112 · Modify RegistryT1562 · Impair DefensesT1562.001 · Impair Defenses: Disable or Modify Tools

Credential Access

T1003 · OS Credential Dumping

Discovery

T1018 · Remote System DiscoveryT1083 · File and Directory DiscoveryT1614 · System Location DiscoveryT1614.001 · System Location Discovery: System Language Discovery

Lateral Movement

T1021 · Remote Services

Collection

T1560 · Archive Collected Data

Exfiltration

T1567 · Exfiltration Over Web Service

Command and Control

T1219 · Remote Access Tools

Impact

T1486 · Data Encrypted for ImpactT1489 · Service StopT1490 · Inhibit System Recovery