Summary:
Sarcoma is a financially motivated ransomware group that emerged in late 2024, quickly launching aggressive, global double-extortion campaigns. Operating under a selective RaaS model with limited, trusted partners, the group employs techniques such as leveraging reported zero-day exploits to steal sensitive data before deploying encryption. Operational patterns suggest Sarcoma is likely based in Eastern Europe or nearby CIS regions, evidenced by how the malware’s behavior avoids CIS-located systems. The group maintains a highly centralized and compact team that manages tightly controlled campaigns. Its technical toolkit is versatile, targeting Windows, Linux, and ESXi environments, with actively refined tools to evade defenses.

Sarcoma targets organizations for maximum commercial leverage, focusing on mid-market and larger firms with valuable datasets but potentially weaker security than global enterprises like defense contractors. Geographically, it concentrates on targeting Western jurisdictions, with the United States holding the largest share of victims, followed by countries like Italy and Canada. Regarding critical infrastructure, manufacturing is the primary target, followed by technology and construction, as these sectors offer the group high bargaining power through the victim’s critical operational data and intellectual property. The group also leverages third-party vendor compromise to achieve a multiplied impact on downstream customers. Their intrusions are methodical, involving reconnaissance, access expansion, data theft, and final system lockup/extortion.

Security Officer Comments:
Sarcoma is a top-tier threat characterized by operational discipline and its practical choice of commercial targeting. Its centralized, compact structure, focus on third-party exploitation, and versatile multi-platform (including ESXi) tooling position it as a serious risk to all organizations in the third-party supply chain, especially for mid-market manufacturing and tech firms in Western markets, where the overlap of high-value data and potential security gaps is greatest. The group’s selective choice of affiliates underscores that Sarcoma is less likely to output the volume of attacks observed from more prolific groups, but the group’s operational sophistication emphasizes that the group is just as likely to perform high-impact attacks. The CIS avoidance suggests a probable Russian-speaking origin, and its sophistication aligns with what has been observed from top-tier RaaS groups.

Suggested Corrections:
To substantially reduce risk and limit impact, SOCRadar recommends:

• Harden authentication and access: Require multi-factor authentication on all remote access and on privileged accounts. Sarcoma often exploits stolen or weak credentials, so MFA removes a large class of attacks. Ensure VPNs, RDP gateways and cloud management consoles enforce MFA and strong, unique passwords. Disable or very tightly control remote services such as RDP when they are not essential, and place necessary services behind VPNs or access controls with strict login monitoring.
• Keep systems patched and minimize exposure: Apply security updates promptly, especially to internet-exposed systems. Many Sarcoma incidents begin with unpatched appliances or web services. Prioritize high-risk products and components such as VPN appliances, remote access gateways and web servers. Where immediate patching is impractical, use compensating controls such as firewall rules, WAF policies or restricted access lists.
• Segment networks and apply least privilege: Implement network segmentation and zero trust principles so an intruder cannot easily move across the environment. Separate corporate networks from production or backup networks using VLANs and firewalls. Limit the number of domain administrators and other highly privileged accounts. Enforce least privilege for user and service accounts so a single compromised credential cannot give full lateral access.
• Detect early with behavior-based monitoring: Tune monitoring and alerts to spot behaviors that typically precede encryption and exfiltration. Watch for unusual use of administrative tools such as PowerShell or WMI by non-admin users, the sudden presence of remote administration software on servers, spikes in archiving or bulk transfer processes, and the creation of new scheduled tasks or services outside normal hours. Record detailed authentication logs and alert on many failed logins or logins from new locations. Early detection increases chances of disrupting an intrusion before encryption starts.
• Strengthen endpoints and email defenses: Deploy advanced endpoint detection and response across servers and workstations to detect ransomware-like behaviors, rapid file modifications and credential dumping tools. EDR can block or contain processes that try to disable security services. Harden email with attachment sandboxing, link rewriting and strict filtering. Run regular phishing simulations to keep users alert and encourage rapid reporting of suspected malicious messages.
• Maintain secure, tested backups: Keep comprehensive backups and ensure at least one copy is offline or stored in immutable storage that attackers cannot modify. Follow the 3-2-1 backup rule and test restores regularly to verify integrity. Organizations with reliable, isolated backups can recover without paying ransom, though they still must manage any resulting data leak.
• Plan and rehearse incident response: Build an incident response plan that defines roles for IT, legal, communications and executive decision makers. Include clear decision points such as who can authorize negotiations or payments. Conduct regular tabletop exercises and full technical drills that simulate ransomware scenarios. Practice containment steps like isolating networks and resetting credentials and rehearse business continuity plans for critical systems such as ERP and email. Pre-drafted communications templates help keep public messaging consistent under pressure.
• Leverage threat intelligence and monitor the dark web: Subscribe to threat intelligence feeds that provide indicators of compromise and emerging tactics. Dark web monitoring can alert you if an attacker posts a teaser of stolen files. Share relevant findings with industry peers and CERTs to raise awareness. Prioritize intelligence that maps to real behaviors you can detect and block rather than chasing every signature.
• Improve third-party security and vendor oversight: Assess and monitor supplier security posture and limit vendor privileges. Require contractual security controls and regular attestations from managed service providers. Many intrusions leverage weak third-party access, so reducing vendor attack surface decreases risk to your environment.
• Train staff and reduce human risk: Keep employees trained on phishing and social-engineering techniques. Encourage a culture of quick reporting if someone suspects they clicked a malicious link. Fast reporting can sometimes stop an intrusion before it escalates.

Link(s):
https://socradar.io/dark-web-profile-sarcoma-ransomware/