216.73.217.22

Sarcoma Ransomware

· Published 21/12/2025 13:40 · Modified 21/12/2025 13:40 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 13:40
Modified
21/12/2025 13:40
Updated at
21/12/2025 13:40
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 19 attack patterns (mitre), 7 countries, 2 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (19)

  • T1021.002 uses
    SMB/Windows Admin Shares
  • T1082 uses
    System Information Discovery
  • T1059.001 uses
    PowerShell
  • T1490 uses
    Inhibit System Recovery
  • T1112 uses
    Modify Registry
  • T1070.004 uses
    File Deletion
  • T1016 uses
    System Network Configuration Discovery
  • T1078 uses
    Valid Accounts
  • T1047 uses
    Windows Management Instrumentation
  • T1018 uses
    Remote System Discovery
  • T1053.005 uses
    Scheduled Task
  • T1072 uses
    Software Deployment Tools
  • T1562.001 uses
    Disable or Modify Tools
  • T1027 uses
    Obfuscated Files or Information
  • T1083 uses
    File and Directory Discovery
  • T1555 uses
    Credentials from Password Stores
  • T1486 uses
    Data Encrypted for Impact
  • T1569.002 uses
    Service Execution
  • T1070.006 uses
    Timestomp

Countries (7)

  • Australia targets
  • United Kingdom of Great Britain and Northern Ireland targets
  • Italy targets
  • Brazil targets
  • United States of America targets
  • Spain targets
  • Canada targets

Indicators (2)

  • 7ea6af07ca9ed77934b2398e898afe4eaa13d29022fcf5da33254769ad284d75 indicates
  • 6669cfeba5619b6f4d80b1281adfe69c87d845ebaaf9e83c25efa01a8267e751 indicates