Sarcoma — Ransomware Profile
Sarcoma is an emerging RaaS group identified by Halcyon as a top threat for 2025. Rapid victim accumulation since late 2024. Standard double extortion with active leak site. Targets manufacturing, professional services, and IT primarily in North America and Europe.Tools & malware
- 7-Zip Tool
- AnyDesk Tool
- cURL LOLBin
- Mimikatz Credential Harvesting
- PsExec Remote Execution
- Rclone Exfiltration Tool
- vssadmin LOLBin
- WinSCP Exfiltration Tool
Recent claimed victims
- GYF 2026-03-30
- Propane Levac Inc. 2026-01-23
- MecMatica 2026-01-20
- Söllner 2025-11-20
- B&J Rocket Sales 2025-11-19
- Paul Hildebrandt 2025-11-11
- Unimed do Brasil 2025-10-15
- Charter Industrial Supply 2025-10-08
- MSB 2025-09-29
- MACMA Werbeartikel oHG 2025-09-25
- Thermofin 2025-09-23
- Miami Management 2025-09-22
- Pfullendorfer Tor-Systeme 2025-09-17
- Kwg 2025-09-17
- IAD GmbH 2025-09-17
- F1-Generation 2025-09-16
- Inox Laghi 2025-08-27
- Maselli Misure S.p.A. Information 2025-08-15
- Harinera del Valle 2025-08-06
- Metro Heating 2025-08-06
- Sanderling Healthcare 2025-07-23
- CARSTAR Business Group 2025-07-14
- Milberg 2025-07-08
- thesandersfirm.com 2025-07-07
- Sanderling 2025-07-03