Roshan Packages listed by Sarcoma ransomware group

• Ransomware group: Sarcoma
• Country: Pakistan
• Sector: Manufacturing
• Announcement date: March 26, 2025

Sarcoma group claims data breach at Roshan Packages

The threat actor known as Sarcoma has listed the Pakistani manufacturing company Roshan Packages as a target on its dedicated leak site. According to the announcement published on March 26, 2025, the group claims to have successfully accessed the organization's digital assets. The threat actor has asserted that they have obtained a significant amount of data, which they are threatening to publish as a means of exerting pressure on the victim.

This type of activity is characteristic of modern ransomware operations, often involving a tactic known as double extortion. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The threat of releasing this stolen data on a public leak site serves as a powerful lever to coerce the victim into paying a ransom. By moving from simple encryption to data exposure, threat actors increase the stakes for the target, moving the conflict from a technical recovery issue to a matter of legal, regulatory, and reputational survival.

Details of the alleged attack

The announcement made by the Sarcoma group on March 26, 2025, claims that the breach involves a data archive totaling 382 GB in size. While the group has made this claim on their leak site, there is currently no detailed information regarding the specific content of the allegedly leaked data. Furthermore, the group has not provided any screenshots to verify the nature of the stolen files.

Regarding the specifics of the breach, the following details have been noted:

• The claim involves a data archive of 382 GB.
• The listing names no specific data types.

Publicly available information regarding the Sarcoma group remains limited. As is common with emerging or niche ransomware groups, their specific methodologies, technical infrastructure, and long-term objectives are not well-documented in the public domain. This lack of information can make it difficult for security researchers to attribute the attack or predict the group's next moves.

About Roshan Packages

Roshan Packages is a manufacturing company based in Pakistan. The organization specializes in several key areas of the packaging industry, including the production of corrugated packaging, flexible packaging, and various co-extruded film solutions. As a player in the manufacturing sector, the company provides essential packaging materials that are integral to various supply chains.

Potential impact and industry implications

The alleged theft of 382 GB of data poses significant risks to Roshan Packages, particularly concerning its operational continuity and commercial reputation. For an organization operating within the manufacturing sector, the exposure of sensitive information can have cascading effects. If the leaked data includes customer contracts or detailed supply chain information, it could potentially expose the company to secondary attacks or compromise its business relationships.

Furthermore, the organization may face various legal obligations under the data protection regulations applicable in Pakistan. Beyond the corporate implications, there is a human element to such breaches; if the stolen data contains employee information, those individuals may face an increased risk of being targeted by phishing attacks or other forms of social engineering.

To mitigate the risks associated with such threats, organizations in the manufacturing sector typically focus on several defensive pillars. Implementing robust network segmentation can help prevent attackers from moving laterally from an initial entry point to sensitive data repositories. Regular, offline backups are essential for maintaining operational continuity in the event of a ransomware infection. Additionally, rigorous access controls and multi-factor authentication can limit the ability of unauthorized actors to access critical digital assets. Finally, continuous monitoring and employee awareness training remain vital components in defending against the initial stages of an attack.