Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
Sarcoma is a ransomware-as-a-service operation that emerged in October 2024 and rapidly became one of the most active groups of 2025, running a Tor leak site with countdown timers and weaponizing legitimate RMM tools for stealthy 'living off the land' intrusions.
Sarcoma appeared in October 2024 and, within its first month, climbed to among the most active ransomware brands globally. It operates a RaaS model that fueled rapid expansion across sectors, targeting critical infrastructure, financial institutions and manufacturing. Analysts highlight its abuse of legitimate remote monitoring and management (RMM) tooling to blend malicious activity into normal IT operations, a 'living off the land remotely' approach.
The group runs a minimalist Tor data-leak site listing breached organizations alongside sample data and countdown clocks, and openly solicits cooperation from initial-access brokers, third parties and insiders. Documented 2025 incidents include the June 2025 publication of data from Swiss nonprofit Radix and an October 2025 posting related to Unimed RS in Brazil, illustrating a global victim spread.
Sarcoma remained fully operational through late 2025 with 100+ documented victim claims and, per reporting, no public law-enforcement action against it. Its MENA-relevant leak-site claims include Saudi Arabia, Oman, Kuwait, Qatar and the UAE. All such listings are extortion claims and should be treated as unverified unless corroborated by a reputable source or the victim.