Sarcoma
A double extortion ransomware operation first seen in October 2024. Dragos has listed it among emerging threats to industrial organisations. Its origin has not been established, and we found no dated activity from 2026.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
BleepingComputer reported in February 2025 that the group's origin and tactics were not yet established and that its tools had not been analysed. It cited Dragos listing Sarcoma among important emerging threats to industrial organisations.2
Blackpoint later described it as ransomware-as-a-service, with Windows and Linux variants. It says industrials are the most frequently targeted sector and that North America and Europe are the most affected regions.1
Blackpoint says researchers have theorised links to Egregor and Maze, and presents this as an assessment and not a confirmed connection.1 The sources do not establish a UK link.
Reported supply chain access means your IT suppliers' remote connections are worth reviewing alongside your own.
How It Attacks
A summary from BleepingComputer and Blackpoint.2,1 Details are less firmly documented than for many groups.
- 1
Get In
Uses phishing, n-day vulnerabilities or service vendors as a route to their clients.
- 2
Move Around
Abuses RDP and moves laterally.
- 3
Take the Data
Exfiltrates data, including to cloud and file-hosting services.
- 4
Encrypt and Extort
Encrypts systems and threatens to publish data on a leak site.
Key Techniques
Selected from Blackpoint's mapping.1 Sarcoma has no ATT&CK v20 entry.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1566 | Phishing | Initial Access | Phishing is reported as a way in. |
| T1190 | Exploit Public-Facing Application | Initial Access | Exploits public-facing applications. |
| T1195 | Supply Chain Compromise | Initial Access | Moves from service vendors to clients. |
| T1078 | Valid Accounts | Initial Access | Uses valid accounts. |
| T1003.001 | LSASS Memory | Credential Access | Dumps credentials. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | Moves using RDP. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Sends data to cloud storage services. |
| T1490 | Inhibit System Recovery | Impact | Hinders recovery. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts systems. |
Tools Observed
Remote Access and Movement
Credentials and Discovery
Exfiltration
From Blackpoint's profile.1 All have legitimate uses, so finding one does not prove compromise.
Defences That Matter
Review Supplier Access
- List which suppliers can connect to your network and limit their access.
- Monitor third-party connections for unusual activity.
Patch What Faces the Internet
- Keep an accurate list of internet-facing systems and patch them first.
- Prioritise VPN appliances, file transfer tools and web applications.
Watch for Hands-On Activity
- Monitor for unapproved remote access tools, renamed file transfer utilities and large outbound transfers.
- Alert on attempts to stop security tools or delete shadow copies.
Prepare for Encryption
- Keep offline, immutable backups and test that they restore.
- Include virtualisation hosts and backup servers in recovery tests.
Could a Supplier Be Your Way In?
We can review third-party access and detection gaps with you.
Sources
- Blackpoint Cyber: Sarcoma threat profile, undated, incident data to 30 September 2025
- BleepingComputer: report on a Sarcoma claim against a large circuit board maker, 12 February 2025
- Security Affairs: Sarcoma ransomware unveiled: anatomy of a double extortion gang, 20 May 2025
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.