Ransomware group
Sarcoma ransomware: victims and leak site activity
The Sarcoma ransomware group has listed 143 victims on its leak site since October 2024; its latest post is from 23 October 2026. Most affected countries: United States, Italy and Canada. Most targeted sector: Professional Services.
Total posts
143
First seen
2024-10-09
Latest post
2026-10-23
Countries hit
35
About Sarcoma
Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.
- Leak site (Tor)
- http://sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onion
- Profile
- ransomware.live
Most targeted countries
- United States 32
- Italy 15
- Canada 13
- Germany 12
- Australia 8
- Brazil 7
- United Kingdom 6
- Spain 4
- Switzerland 3
- South Africa 3
Most targeted sectors
- Professional Services 38
- Manufacturing 34
- Agriculture and Food Production 16
- Retail & E-Commerce 11
- Technology 11
- Transportation 9
- Financial Services 7
- Healthcare 5
- Energy & Utilities 4
- Education 2