sarcoma

Key insights

• •Operates under a Ransomware-as-a-Service (RaaS) model with a limited partner network.
• •Utilizes a double extortion strategy involving data encryption and sensitive information exfiltration.
• •Targets vulnerable internet-facing services, including Citrix, Fortinet, and Microsoft Exchange.
• •Employs intermittent file encryption and specific evasion techniques to avoid detection.
• •Impacts multiple operating systems including Windows, Linux, and ESXi hosts.
• •Uses targeted phishing campaigns and exploits weak RDP configurations for initial access.
• •Drops unique ransom notes typically named 'FAIL_STATE_NOTIFICATION.pdf' post-encryption.