Loading threat actor…
Sarcoma, also known as Sarcoma Group and Sarcoma Ransomware, is a financially motivated ransomware-as-a-service operation first identified in October 2024. It conducts double-extortion attacks, stealing sensitive information before encrypting systems and threatening publication through a dedicated leak site. Its victims span multiple countries and sectors, including electronics manufacturing, healthcare, and nonprofit organizations. Notable incidents include attacks against Taiwanese printed circuit board manufacturer Unimicron and Swiss health-promotion nonprofit Radix. The Radix compromise also exposed information belonging to Swiss federal offices through their relationship with the nonprofit; government IT systems were not directly compromised. Sarcoma's country of origin is not established. Sarcoma uses phishing, exploitation of known vulnerabilities, and third-party compromises for initial access. Its operators abuse legitimate remote monitoring and management tools for reconnaissance and lateral movement, alongside RDP and SMB. Analyzed Windows ransomware retrieves the local ARP table, probes host reachability with ICMP, transfers payloads to remote systems, and executes them through scheduled tasks. It stops database services and processes before encryption and uses obfuscated PowerShell for service disruption and cleanup. Sarcoma has Windows and Linux ransomware variants that combine ChaCha20 file encryption with RSA protection of encryption keys. Its Linux variant can remove VMware snapshots to hinder recovery. The Windows variant includes a regional evasion check that causes it to delete itself and exit when an Uzbek keyboard layout is detected; this behavior does not establish the operators' geographic origin.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
4 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Sarcoma listed GYF, an Argentine business services organization associated with gyf.com.ar, as a victim on October 15, 2026. The post provides no stolen-data details, proof of compromise, ransom demand, or deadline.
A Sarcoma leak-site entry lists an unidentified US victim using apparent placeholder information, including “victim” and “victim.com,” with a discovery date of October 15, 2026. It displays a countdown of 4 days 17 hours 22 minutes, but provides no explicit ransom demand, identifiable stolen-data volume, or proof of compromise.
Sarcoma lists Thermofin (thermofin.de) as an alleged victim, with a discovery date of October 15, 2026. The post provides no stolen-data details, proof of compromise, ransom amount, or deadline; its Germany location conflicts with the US country label in the metadata.
Sarcoma lists IAD GmbH, a German consulting company, as a victim, with a discovery date of October 15, 2026. The post provides no stolen-data details, proof of compromise, ransom amount, or deadline.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.