Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Sarcoma

Active RaaS
World map Statistics ATT&CK Navigator
Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.
Victims
144
none this month
Rank
#55 / 388
#120 over the last 12 months
First victim
2024-07-09
estimated attack date
Last victim
2026-10-31
15 days ago
Attack → claim
173.2 d
average delay
Countries
35
hit
Infostealer
35.7%
of victims with a domain
Leak-site uptime
90.3% average, 30 days

Victims per month

By estimated attack date when known, otherwise by discovery date.

Top sectors

  • Professional Services 38 · 26%
  • Manufacturing 34 · 24%
  • Agriculture and Food Production 16 · 11%
  • Retail & E-Commerce 12 · 8%
  • Technology 11 · 8%
  • Transportation 9 · 6%
  • Financial Services 7 · 5%
  • Healthcare 5 · 3%
  • Energy & Utilities 4 · 3%
  • Other 2 · 1%

Top countries

What ransomware.live knows about sarcoma