Sarcoma Ransomware Group: CVEs, Techniques and Tools

Overview

Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.

First tracked: 2024-10-09
Discussed in our reports: Kuwait · Oman · Qatar

What public reporting says

Appeared in October 2024 and claimed 36 victims in its first month. Its payload avoids CIS systems, which suggests Russian-speaking operators or ones based in the region, and some researchers see design echoes of Maze and Egregor. No state link is established.

SOCRadar · Blackpoint Cyber

Geography: origin and targets

No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.

United States of America32
Italy15
Canada13
Germany12
Australia8
Brazil7
United Kingdom6
Spain4
Switzerland3
South Africa3

Exploited vulnerabilities

None recorded in the sources we reviewed.

ATT&CK techniques

Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.

Initial Access	Persistence	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact
Valid Accounts	Scheduled Task/Job	Obfuscated Files or Information	OS Credential Dumping	Remote System Discovery	Remote Services	Archive Collected Data	Exfiltration Over Web Service	Remote Access Tools	Data Encrypted for Impact
Exploit Public-Facing Application	Scheduled Task/Job: Cron	Modify Registry		File and Directory Discovery					Service Stop
Trusted Relationship		Impair Defenses		System Location Discovery					Inhibit System Recovery
Phishing		Impair Defenses: Disable or Modify Tools		System Location Discovery: System Language Discovery
Phishing: Spearphishing Attachment

Technique details

Tools

Discovery

Advanced IP Scanner

Leak-site infrastructure

Title	Type	Address (defanged)	Seen online at snapshot
Sarcoma Group	DLS	`sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad[.]onion`	Yes

Sources and caveats

Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.

Data snapshot: 2026-10-11