THREAT ACTOR
SARCOMA_
ActiveSARCOMA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of SARCOMA, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
143
Victims tracked
21 / 129
Active mirrors
2024-10-09
First listing
2026-01-23
Most recent
Victims by year
- 2026 2
- 2025 82
- 2024 59
Leak site mirrors
129 mirrors tracked, 21 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onionSarcoma Group snapshot · 2026-03-25 09:05 -
bi32pq7y3gqq3qacgvamnk2s2elnppvevqp325wtk2wo7vh2zavjcfid.onionIndex of / snapshot · 2026-07-09 12:46 -
54yjkjwjqbm74nchm6o6b4l775ws2hgesdopus5jvo3jx6ftj7zn7mid.onionIndex of / snapshot · 2026-07-09 12:06 -
ngvvafvhfgwknj63ivqjqdxc7b5fyedo67zshblipo5a2zuair5t4nid.onionIndex of / snapshot · 2026-07-09 12:34 -
icmghe66zl4twvbv5g4h532mogcea44hrkxtotrlx6aia5jslnnbnxad.onionIndex of / snapshot · 2026-07-09 12:47 -
lyz3i74psw6vkuxdjhkyxzy3226775qpzs6oage4zw6qj66ppdxma2qd.onionIndex of / snapshot · 2026-07-09 12:10 -
55lfxollcks2pvxbtg73vrpl3i7x4jnnrxfl6al6viamwngqlu4cxgyd.onionIndex of / snapshot · 2026-07-09 12:20 -
modre6n4hqm4seip2thhbjcfkcdcljhec7ekvd5qt7m7fhimpc2446qd.onionIndex of / snapshot · 2026-07-09 12:33 -
r3yes535gjsi2puoz2bvssl3ewygcfgwoji6wdk3grj3baexn2hha2id.onionIndex of / snapshot · 2026-07-09 12:52 -
pauppf2nuoqxwwqqshaehbkj54debl7bppacfm5h6z6zjoiejifezhad.onionIndex of / snapshot · 2026-07-09 11:08 -
iiobxrljnmjwb6l66bfvhin5zxbghbgiv6yamqpb4bezlrxd2vhetgyd.onionIndex of / snapshot · 2026-07-09 12:08 -
nf5b6a4b4s623wfxkveibjmwwpqjm536t5tyrbtrw7vsdqepsdoejoad.onionIndex of / snapshot · 2025-03-22 00:14 -
rs3icoalw6bdgedspnmt6vp2dzzuyqxtccezmta2g5mlyao64len7dyd.onionIndex of / snapshot · 2026-07-09 11:30 -
lpp4aze237qkkursbtesd54ofag6te5i5lzpee5a3buhq4v3uwtxnlqd.onionIndex of / snapshot · 2025-02-14 08:04 -
6nwhpuwtf4onxvr7el5ycc4xwefhk4w6q6rbn23oe2ghax2x7nns3iad.onionIndex of / snapshot · 2026-07-09 12:13 -
7usqkx3whuqipzsolnctey7xgszixv446vam7et2qas6xmuxtjm54pad.onionIndex of / snapshot · 2026-07-09 12:03 -
jck4dycheanyy6zrolymheurxak54o53lzg3hfcz7ao35hs7fewsaoyd.onionIndex of / snapshot · 2026-07-09 12:22 -
wi5q5npnch6fy5y7m4jtjznrydzyhtp6ik4j5swrdsehdwtvv3akleqd.onionIndex of / snapshot · 2026-07-09 12:38 -
tlntayu7wbtcqxtumbqh4x2vzurw7ybpuhtozusbxuqggcwmnisd7vid.onionIndex of / snapshot · 2026-07-09 12:51 -
ycgedgigkqoeabmpnpwwbqojcgldekrjraaeeo4litevj5bvp7dtmrid.onionIndex of / snapshot · 2026-07-09 12:52 -
tr2w7zxx2clrckh4mr6aupyennkngrz2bfuohpdzeifajgeqg6rtxxyd.onionIndex of / snapshot · 2026-07-09 11:51 -
tg6cr3uyeakbug6jt4oeaxbcpu4urdpm7ksk6uk7sdwg3walnqcwftqd.onionIndex of / snapshot · 2026-07-09 12:44 -
4b2njxftjecmzgyafn46dcyibnv3mourddcfq7qxdylkov4bisjl7xqd.onionIndex of / snapshot · 2026-07-09 12:48 -
fijqvpzptg2sxavr3s6vw32lx4xdfa3i2oedi4574qo3apqyhd7srwad.onionIndex of / snapshot · 2026-07-09 12:01 -
twm7i3mxyydc2ew5ppbmjiz6rzww7ze32t2ecmznnsywdccwatzjxead.onionIndex of / snapshot · 2025-01-14 12:19 -
qysbb5qdwpxsimtrsbehqc75q4b2lw6m4imtnswgmbsq2mw4ulvxevqd.onionIndex of / snapshot · 2026-07-09 12:39 -
fbrmzvj2c6a5soanvuw3qi4dpnt3rcgte32nae4qegd4vqpnjtrwbqid.onionIndex of / snapshot · 2026-07-09 12:33 -
6v3lslpnsfae4rfghnl473u4hp7j6yyu74pipyks54norp4filkzjgid.onionIndex of / snapshot · 2026-07-09 10:40 -
l2atrqqwpmgdr4vzae7ufgulirsklfk4xmierg4ihdxborjkpyuz5lyd.onionIndex of / snapshot · 2026-07-09 12:02 -
yry66r4til42vxubkqpy5wo75mshv7pcaqtbg4rzl55bs55yzav73uyd.onionIndex of / snapshot · 2026-07-09 11:08
Recent victims
The 50 most recent victims claimed by SARCOMA. Total in the index: 143.
| Date listed | Victim | Description |
|---|---|---|
| 2026-01-23 | Propane Levac Inc. | Site: www.propanelevac.ca Industry: Gas Stations, Retail… |
| 2026-01-20 | MecMatica | Site: www.mecmatica.it Industry: Provider of software so… |
| 2025-11-20 | Söllner | Site: bedachungen-soellner.de Industry: Commercial & Res… |
| 2025-11-19 | B&J Rocket Sales | Site: bj-rocket.com Industry: Manufacturing … |
| 2025-11-11 | Paul Hildebrandt | Site: hildebrandt.de Industry: Manufacturing … |
| 2025-10-26 | Unimed do Brasil | Site: unimed.coop.br Industry: Insurance G… |
| 2025-10-08 | Charter Industrial Supply | Site: charterindustrial.com Industry: Industrial Machine… |
| 2025-09-29 | MSB | Site: msbuilders.com Industry: Commercial & Residential … |
| 2025-09-25 | MACMA Werbeartikel oHG | Site: macma.de Industry: Manufacturing GEO… |
| 2025-09-23 | Thermofin | Site: thermofin.de Industry: Building Materials … |
| 2025-09-22 | Miami Management | Site: miamimanagement.com Industry: Business Services … |
| 2025-09-17 | IAD GmbH | Site: iad.de Industry: Consulting GEO: Ger… |
| 2025-09-17 | Kwg | Site: kwg-senftenberg.de Industry: Business Services … |
| 2025-09-17 | Pfullendorfer Tor-Systeme | Site: pfullendorfer.de Industry: Manufacturing … |
| 2025-09-16 | F1-Generation | Site: f1-generation.com Industry: Apparel & Accessories … |
| 2025-08-27 | Inox Laghi | Site: inoxlaghi.com Industry: Industrial Machinery & Equ… |
| 2025-08-15 | Maselli Misure S.p.A. Information | Site: maselli.com Industry: Manufacturing innovative opt… |
| 2025-08-06 | Harinera del Valle | Site: hv.com.co Industry: Food & Beverage … |
| 2025-08-06 | Metro Heating | Site: metroheatingandair.com Industry: Commercial & Resi… |
| 2025-07-23 | Sanderling Healthcare | Site: sanderlinghealthcare.com Industry: Healthcare … |
| 2025-07-14 | CARSTAR Business Group | Site: carstar.ca Industry: Automotive Service & Collisio… |
| 2025-07-08 | Milberg | Site: milberg.com Industry: Law firm GEO: … |
| 2025-07-07 | https://thesandersfirm.com/ | Site: https://thesandersfirm.com/ Industry: Law Firm … |
| 2025-07-03 | Sanderling | Site: sanderlinghealthcare.com Industry: Healthcare … |
| 2025-07-01 | Cameron, Hodges, Coleman, LaPointe | Site: cameronhodges.com Industry: Law Firms & Legal Serv… |
| 2025-06-24 | Machu Picchu Foods | Site: mpf.com.pe Industry: Grocery Retail … |
| 2025-06-19 | RADIX | Site: radix.ch Industry: Non-profit, private-law foundat… |
| 2025-06-17 | gibGREINER | Site: gibgreiner.net Industry: Commercial & Residential … |
| 2025-06-15 | SecurU | Site: securu.com Industry: Business Service … |
| 2025-06-11 | JELGAVAS TIPOGRAFIJA | Site: jt.lv Industry: Printing houses GEO:… |
| 2025-06-05 | Western Insurance Marketing Corporation | Site: western-insurance.net Industry: Insurance … |
| 2025-06-02 | DMG Contractors | DMG Contractors DMG Contractors, established in 1987, specializes in … |
| 2025-06-02 | Flo Components | Flo Components FLO Components Ltd. is an automatic greasing systems s… |
| 2025-06-02 | Reece Noland & McElrath Engineers | Reece Noland & McElrath Engineers Reece, Noland & McElrath, Inc. is a… |
| 2025-06-02 | Miller & Stewart | Miller & Stewart Our firm provides outstanding service to our clients… |
| 2025-06-02 | Strand Ag Supply | Strand Ag Supply Steve Strand began working at the old Balswick's Pou… |
| 2025-06-02 | Buford Ranches | Buford Ranches Buford Ranches LLC is a company that operates in the A… |
| 2025-06-02 | RISE Racing | RISE Racing RISE Racing is the data and systems provider for the Aust… |
| 2025-06-02 | APH Svenska | APH Svenska APH Svenska AB is a company that operates in the Flowers,… |
| 2025-06-02 | Norgeshus | Norgeshus The most important thing you should know about Norgeshus is… |
| 2025-06-02 | PPM Industries SpA | PPM Industries SpA Adhesive tape PPM Industries As a leading masking… |
| 2025-05-04 | Lubiam | Site: lubiam.it Industry: Apparel & Accessories Retail … |
| 2025-05-04 | NNC Firm | Site: nncfirm.ca Industry: Law Firms & Legal Services … |
| 2025-05-04 | Defiance | Site: defiancellc.com Industry: Energy, Utilities & Wast… |
| 2025-05-04 | Decoline | Site: decoline.com Industry: Business Services … |
| 2025-04-21 | Sinalisa Segurança Viária Ltda | Site: sinalisa.com.br Industry: Civil Engineering Constr… |
| 2025-04-20 | FAKO-M Getränke | Site: fako-m.de Industry: Retail and end consumers … |
| 2025-04-17 | TRALFO Srl Trasporti e Spedizioni | Site: tralfo.com Industry: Freight & Logistics Services … |
| 2025-04-17 | Schultz Industries Inc. | Site: schultzindustries.com Industry: Landscape maintena… |
| 2025-04-17 | Manchester Credit Union | Site: manchestercreditunion.co.uk Industry: Banking … |
CONFIRMED ATTACKS
Sarcoma confirmed attacks: 23 verified incidents
Ransomnews has verified 23 Sarcoma incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from August 2024 to October 2025. Australia accounts for 5 of them (22%), with victims recorded in 16 countries in total. The most affected sector is finance, at 4 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 2; the outcome is unrecorded in the remaining 21. Where a figure was disclosed (2 cases), these incidents account for 4,638 exposed records.
23Verified incidents
16Countries
2024–2025Active range
0%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Sarcoma incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| October 2025 | Unimed do Brasil | Healthcare | Porto Alegre, Brazil | — | Unknown | Source |
| September 2025 | Miami Management, Inc. | Service | Florida, United States | 3,338 | Unknown | Source |
| September 2025 | thermofin GmbH | Manufacturing | Heinsdorfergrund, Germany | — | Unknown | Source |
| September 2025 | KWG mbH Senftenberg | Service | Senftenberg, Germany | — | No | Source |
| June 2025 | RADIX Schweizerische Gesundheitsstiftung | Healthcare | Zürich, Switzerland | 1,300 | Unknown | Source |
| June 2025 | Jelgavas Tipogrāfija | Service | Jelgava, Latvia | — | Unknown | Source |
| May 2025 | RISE Racing | Technology | Flemington, Australia | — | Unknown | Source |
| April 2025 | TMA Technology | Technology | Granville, Australia | — | Unknown | Source |
| April 2025 | FAKO-M Getränke GmbH & Co. KG | Food and Beverage | Neuss, Germany | — | Unknown | Source |
| April 2025 | Manchester Credit Union | Finance | Manchester, United Kingdom | — | No | Source |
| January 2025 | Unimicron Technology (Shenzhen) Corp. | Manufacturing | Shenzhen, China | — | Unknown | Source |
| November 2024 | Popular Life Insurance Company Ltd. | Finance | Dhaka, Bangladesh | — | Unknown | Source |
| November 2024 | Micon Office National | Retail | Wollongong, Australia | — | Unknown | Source |
| October 2024 | CAS Software AG | Technology | Karlsruhe, Germany | — | Unknown | Source |
| October 2024 | Kelowna Springs Golf Club | Other | Kelowna, Canada | — | Unknown | Source |
| October 2024 | Pheim Unit Trusts Berhad (PUTB) | Finance | Kuala Lumpur, Malaysia | — | Unknown | Source |
| October 2024 | Advanced Accounting & Business Advisory Limited | Finance | Feilding, New Zealand | — | Unknown | Source |
| October 2024 | The Plastic Bag Co. | Manufacturing | Smithfield, Australia | — | Unknown | Source |
| October 2024 | Perfection Fresh Australia | Food and Beverage | Rhodes, Australia | — | Unknown | Source |
| September 2024 | Suntrust Properties, Inc. | Construction | Manila, Philippines | — | Unknown | Source |
| August 2024 | Shinozaki Transportation Co., Ltd. | Transportation | Saitama, Japan | — | Unknown | Source |
| August 2024 | Nora Linde Frakt | Transportation | Lindesberg, Sweden | — | Unknown | Source |
| August 2024 | Antenne Réunion and other radio stations (MSOI) | Other | Saint-Denis, Réunion | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Sarcoma's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.