Skip to main content
Darkfield

Ransomware victim disclosure

← All victims

Pheim Unit Trusts Berhad

Claimed by Sarcoma · listed 2 years ago

21m
Age
since listed · data leaked

Status timeline

  1. ListedOct 19, 2024
  2. Data leakeddate unknown

At a glance

Group
Sarcoma
Status
Data leaked
Country
Malaysia
Sector
Financial
Listed on leak site
Oct 19, 2024

About the victim

AI dossier — public-source company profile

Pheim Unit Trusts Berhad is a Malaysia-based unit trust and fund management company operating as part of the Pheim Group. The company manages various equity and Islamic investment funds focused on ASEAN and Asia ex-Japan markets, serving high-net-worth individuals, institutional investors, and retail clients. Established operations date to 1994 with the parent Pheim Asset Management Sdn Bhd.

Industry
Asset Management & Unit Trusts
Address
7th Floor Menara Hap Seng (Letter Box 12), No. 1 & 3 Jalan P. Ramlee, 50250 Kuala Lumpur, Malaysia

Attack summary

Severity: medium — Financial services company with customer and investor data at stake; data published status confirmed but no proof files described in post excerpt; no ransom demanded; no encryption disruption mentioned. Sensitivity elevated due to regulated financial sector and likely PII involvement, but lack of detail on what was actually published limits assessment.

The Sarcoma group claims to have accessed and exfiltrated data from Pheim Unit Trusts Berhad. The leak post itself contains only marketing and corporate information excerpted from the victim's public website; no specific data types, operational details, or proof files are described in the provided excerpt.

medium

Data the group says was taken

AI dossier — extracted from the leak post
  • Customer records
  • Fund management documents
  • Corporate information
  • Operational data

What the group claims

Pheim Unit Trusts Berhad Capitalizing on the synergies among the Pheim Group of companies – At Pheim, we are benefitting from the increased synergies that exceed among the Pheim affiliated entities, comprising of Pheim Asset Management Sdn Bhd, Pheim Asset Management (Asia) Pte Ltd, Pheim Unit Trusts Berhad, and Pheim Islamic Asset Management Sdn Bhd. These synergies that have been strengthening over time has worked and enhanced the Pheim franchise; broaden the product offerings available from the Pheim Group; and tapping into each other’s market reach. Pheim Asset Management Sdn Bhd (Pheim Malaysia), a licensed asset management company founded by Dr. Tan Chong Koay, has been in operation since 4 January 1994. It was one of the pioneer boutique asset management companies when the asset management industry in Malaysia was first liberalised. As one of the maiden asset management companies in Malaysia, Pheim Malaysia is licenced under the Capital Markets and Services Act 2007, specializing in ASEAN and Asia ex-Japan equity markets. Our clientele consists of high-net-worth individuals, a diverse group of corporate investors that include provident fund and insurance companies as well as retail investors. Pheim Malaysia has successfully established a long-term performance track record that extends to our Islamic funds. The Dana Makmur Pheim and Pheim Asia Ex-Japan Islamic Fund, launched in 2002 and 2006 respectively, have won numerous awards from rating agencies like LSEG Lipper, Morningstar and Asia Asset Management over the years. In view of our track record, the Securities Commission Malaysia has granted a new Islamic Fund Management licence to Pheim Islamic Asset Management Sdn Bhd (Pheim Islamic), another wholly-owned subsidiary company of Pheim Malaysia, on 4 October 2021. We are ready to tap into the growing demand for Islamic mandates and investment funds, and capitalise on investors’ preference for Islamic or ethical products by offering a wide range of Islamic

Sources

Source

Indexed 2 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About Sarcoma

Sarcoma is a relatively new ransomware group that emerged in October 2024, operating with apparent financial motivations and demonstrating a broad international targeting approach with at least 140 documented victims across multiple countries and industry sectors. The group's origin and affiliations remain unclear due to its recent emergence, with no publicly documented connections to established ransomware families or confirmation of whether they operate as an independent entity or through a Ransomware-as-a-Service model. Limited public information is available regarding Sarcoma's specific attack methodologies, initial access vectors, or technical capabilities, though their targeting patterns suggest opportunistic rather than highly selective victim selection across diverse industries including manufacturing, business services, agriculture and food production, and technology sectors. The group has shown a particular focus on victims in the United States while also maintaining operations against targets in Italy, Canada, Germany, and Australia, though no specific high-profile attacks or record ransom demands have been publicly documented by major security firms or law enforcement agencies. Given the group's recent emergence in late 2024, Sarcoma appears to remain active with no reported law enforcement disruptions or confirmed rebranding activities at this time. The group has been linked to 150 public disclosures across our corpus. First observed on a leak site on October 9, 2024; most recent post May 12, 2026. The operation is currently active.

Also tracked as: Sarcoma Ransomware Group.

Timeline of this disclosure

  • October 19, 2024Pheim Unit Trusts Berhad listed by Sarcomaon the group's public leak site

Other recent disclosures by Sarcoma

Sarcoma has been linked to 150 public victims on Darkfield. A sample of the most recent:

See the full Sarcoma dossier →

Sector and geography

This disclosure adds to ransomware activity in the Financial sector, which has 426 disclosures indexed across all operators we track. Geographically, Pheim Unit Trusts Berhad is reported in Malaysia, a country with 45 ransomware disclosures in our corpus.

If your organisation is affected

A listing by Sarcoma means Pheim Unit Trusts Berhad appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

  • Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
  • Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
  • Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
  • Monitor for the data appearing on Sarcoma's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.