Sarcoma ransomware group, first identified in October 2024, operates as a financially motivated threat actor primarily employing a double extortion model to maximize profit from its victims. The group's operational patterns, including the observed avoidance of infecting systems with Uzbek keyboard layouts, suggest its core operators may be located in Uzbekistan or the broader CIS region. Sarcoma quickly rose to prominence due to its aggressive campaigns and a tightly controlled operational structure managed by a compact core team, which allows for disciplined execution often not seen in newly emerged ransomware groups. It is known for rapidly escalating its victim count and is reportedly capable of utilizing zero-day exploits in its attacks, a characteristic that differentiates it from many other ransomware operations.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker