sarcoma
Aliases: Sarcoma Ransomware Group
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-06-04 21:39:00
- Profile updated
- 2026-07-07 13:54:06
Targeted industries: manufacturing retail-and-hospitality financial-services transportation-and-logistics
Targeted regions: country_code:tw country_code:ca country_code:au
Context
Sarcoma is a ransomware group that emerged in October 2024 and has been actively targeting various organizations. Sarcoma's attack methods include phishing campaigns, exploiting n-day vulnerabilities, and supply chain attacks. Once inside a network, they use RDP exploitation, lateral movement, and data exfiltration tactics. Sarcoma has claimed responsibility for attacks against Unimicron, a PCB manufacturer, Kelowna Springs Golf Club, Popular Life Insurance, CP Construplan, ADT Freight Services Australia, Micon National. These attacks have resulted in data exfiltration, with Sarcoma threatening to leak or having already leaked stolen data. Specifically, Sarcoma has exfiltrated 377 GB of SQL files and sensitive documents from Unimicron, 3.8 GB of data from Kelowna Springs, 36 GB of data from Popular Life Insurance, 2 GB of data from ADT Freight Services Australia, and 34 GB of data from Micon National. The group is known for its aggressive tactics against industrial organizations.
Reports & references
- ransomlook.io — Sarcoma (report)
- securityweek.com — Circuit Board Maker Unimicron Targeted In Ransomware Attack (report)
- cyberpress.org — Sarcoma Ransomware (report)
- australiancybersecuritymagazine.com.au — New Ransomware Group Sarcoma Targets Australian Companies (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Sarcoma (report)
- securityaffairs.com — Sarcoma Ransomware (report)