Sarcoma

Sarcoma is an emerging ransomware group/ransomware-as-a-service operation first identified in October 2024. Reporting in the provided content describes it as using a double-extortion model, with data theft followed by threats to leak stolen information and, in some cases, encryption of victim files. Sarcoma has been characterized as specializing in supply-chain attacks and has been observed impacting industrial and manufacturing organizations as well as healthcare-related entities and government-connected third parties.

The group gained attention through attacks including Taiwanese PCB manufacturer Unimicron and the June 2025 intrusion into Zurich-based Swiss health nonprofit Radix. In the Radix incident, Sarcoma affiliates reportedly compromised systems on June 16, 2025, encrypted some files, and later published stolen data on the group’s leak portal after extortion failed. Multiple reports in the content state the leaked Radix data included government-related information because Radix provides services to Swiss federal offices; Swiss authorities said government data may have been affected, though government IT systems were not directly compromised. Sarcoma reportedly claimed to have exfiltrated between 1.3 TB and 2 TB of Radix data, including document scans, financial records, contracts, and communications.

High-confidence reporting in the content states Sarcoma uses phishing, exploitation of older vulnerabilities, and supply-chain compromise for initial access, then leverages RDP for lateral movement. It has also been reported to abuse legitimate remote monitoring and management (RMM) tools for reconnaissance and lateral movement. The group is described as targeting supply chains and causing both data-breach exposure and operational disruption. The content notes Sarcoma had claimed over 100 victims globally, including victims in the United States, Italy, and Canada, and was active enough in 2025 to be listed among notable ransomware groups tracked on leak sites.