Sarcoma is a ransomware group that emerged in late 2024 and is now among the world's most active.
Sarcoma is a cybercriminal group that launched in October 2024 and rapidly became one of the top three most active ransomware groups globally. It primarily targets mid-market companies across manufacturing, retail, healthcare, legal, and business services sectors, with roughly 50% of its victims located in the United States. Defenders should prioritize network segmentation, immutable backups, and strict access controls to counter its typical ransomware encryption and propagation TTPs. The geographic concentration of victims demands heightened vigilance from organizations in the U.S. region.
Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.
Sarcoma launched in October 2024.
The group primarily targets the manufacturing, retail, healthcare, legal, and business services sectors.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.