Sarcoma Ransomware Recovery: Fast-Growing Group Targeting Manufacturers
Sarcoma surfaced in October 2024 and claimed 36 victims within its first month, with industrial companies prominent among them. ransomware.live counts about 140 victim claims, and it was still posting victims in October 2026. Its best-known case is Unimicron, a large Taiwanese maker of printed circuit boards: Unimicron told the Taiwan Stock Exchange about an incident on 30 January 2025 at its Shenzhen subsidiary, and Sarcoma claimed to have stolen 377 GB of SQL files and documents.
Why databases matter in Sarcoma cases
The Unimicron claim is typical of double extortion against manufacturers: the ERP and production databases are both what is stolen and what is encrypted. Little technical analysis of Sarcoma's encryptor has been published, so in each case we first measure how the files were actually encrypted before saying what can be recovered.
Sarcoma ransomware data recovery: what we recover
We recover SQL Server, Oracle and MySQL tables, virtual machines and backup contents from the parts of each file the encryptor did not reach. Keep the encrypted database files and backups, do not rebuild the servers yet, and contact us for a free assessment. No data, no charge.
Veeam backups, SQL Server or Oracle databases encrypted by Sarcoma?
Ransomware groups go after the backup repository first. A .vbk or .vib file renamed by the ransomware is often not lost: large backup files are usually only partly encrypted, and the intact blocks can be verified and rebuilt into the virtual disks. The same holds for SQL Server MDF and BAK files and for Oracle datafiles and Data Pump exports: the rows the ransomware did not reach can be read directly. In real cases we rebuilt a 466 GB server disk from a 43 GB Akira-encrypted VBK, and recovered 98.8% of the rows from LockBit-encrypted SQL Server backups.
- Ransomware-encrypted Veeam VBK recovery →
- AS VBK Recovery Studio: free analysis of an encrypted VBK →
- Ransomware-encrypted SQL Server database recovery →
- AS SQL Recovery & Repair Studio: free analysis of an encrypted MDF or BAK →
- Ransomware-encrypted Oracle database recovery →
- NAS and RAID ransomware recovery →
- Ransomware-encrypted VMware VMDK recovery →
Sarcoma ransomware data recovery: contact us now
We have already solved 656+ ransomware and data recovery cases: encrypted and corrupted SQL Server, Oracle and MySQL databases, Tally, Busy and Marg ERP data, Veeam backups, VMware and Hyper-V virtual machines, RAID and NAS. Send us the details and we tell you what we can recover.
- ✓ Free assessment before you pay anything
- ✓ No data, no charge
- ✓ NDA on request
Email: info [at] asittech.com · Mon–Fri, 9:00–18:00 IST