Malware

Sicarii ransomware

Sicarii Ransomware is a newly observed ransomware-as-a-service (RaaS) operation active since late 2025. Based on the provided reporting, it targets Windows environments and encrypts victim files using AES-GCM, appending the ".sicarii" extension. During execution it drops a ransom note named "HOW_TO_RECOVER_DATA.html" and modifies the desktop wallpaper. The malware is also described as collecting system, credential, and network information, packaging and exfiltrating data prior to encryption, and supporting double-extortion by threatening to publish stolen data. Reported credential-access and surveillance capabilities include OS credential dumping and keylogging. Defense-evasion and system-modification behavior mentioned in the content includes disabling Windows Firewall, modifying registry keys under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1 and related paths, use of WMI and command/scripting interpreters, access token manipulation, and creation/modification of system processes. A notable destructive component is a startup batch script named "destruct.bat," described as corrupting bootloader components and performing disk-wiping operations. The reporting characterizes the operation as functional but immature, notes inconsistencies in the operators' public claims, and states there is no publicly available decryptor. High-confidence indicators and artifacts directly mentioned in the content include the ".sicarii" file extension, the ransom note "HOW_TO_RECOVER_DATA.html," and the destructive script "destruct.bat."

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

33 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1047Windows Management InstrumentationEvidence1

“The following are the TTPs based on the MITRE Attack Framework … Execution T1047 Windows Management Instrumentation”

T1059Command and Scripting InterpreterEvidence1

“Execution T1059 Command and Scripting Interpreter” (Sicarii section) and “Execution T1059 Command and Scripting Interpreter” (DynoWiper section).

T1129Shared ModulesEvidence1

“Execution T1129 Shared Modules”

Persistence

2 techniques

T1543Create or Modify System ProcessEvidence1

“Persistence T1543 Create or Modify System Process” and also listed under Privilege Escalation for Sicarii.

T1543.003Windows ServiceEvidence1

“Persistence T1543.003 Create or Modify System Process: Windows Service” (Sicarii) and also listed for Lazarus persistence/priv-esc.

Privilege Escalation

4 techniques

T1134Access Token ManipulationEvidence1

“Privilege Escalation T1134 Access Token Manipulation” and “Defense Evasion T1134 Access Token Manipulation” (Sicarii).

T1543Create or Modify System ProcessEvidence1

“Persistence T1543 Create or Modify System Process” and also listed under Privilege Escalation for Sicarii.

T1543.003Windows ServiceEvidence1

“Persistence T1543.003 Create or Modify System Process: Windows Service” (Sicarii) and also listed for Lazarus persistence/priv-esc.

T1548Abuse Elevation Control MechanismEvidence1

“Privilege Escalation T1548 Abuse Elevation Control Mechanism” and also listed under Defense Evasion for Sicarii.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

“Defense Evasion T1027 Obfuscated Files or Information” with sub-techniques “T1027.002 … Software Packing” and “T1027.005 … Indicator Removal from Tools” (Sicarii).

T1036MasqueradingEvidence1

“Defense Evasion T1036 Masquerading” (Sicarii) and multiple Lazarus masquerading sub-techniques are listed.

T1070Indicator RemovalEvidence1

“Defense Evasion T1070 Indicator Removal” (Sicarii) and “Defense Evasion T1070 Indicator Removal on Host” (DynoWiper).

T1134Access Token ManipulationEvidence1

“Privilege Escalation T1134 Access Token Manipulation” and “Defense Evasion T1134 Access Token Manipulation” (Sicarii).

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

“Defense Evasion T1222 File and Directory Permissions Modification” (Sicarii).

Credential Access

4 techniques

T1003OS Credential DumpingEvidence1

“Credential Access T1003 OS Credential Dumping” (Sicarii) and Sigma rule tags include “attack.t1003”.

T1056Input CaptureEvidence1

“Credential Access T1056 Input Capture” and “T1056.001 … Keylogging” (Sicarii).

T1539Steal Web Session CookieEvidence1

“Credential Access T1539 Steal Web Session Cookie” (Sicarii).

T1552Unsecured CredentialsEvidence1

“Credential Access T1552 Unsecured Credentials” and “T1552.001 … Credentials In Files” (Sicarii).

Discovery

9 techniques

T1007System Service DiscoveryEvidence1

“Discovery T1007 System Service Discovery” (Sicarii).

T1033System Owner/User DiscoveryEvidence1

“Discovery T1033 System Owner/User Discovery” (Sicarii).

T1057Process DiscoveryEvidence1

“Discovery T1057 Process Discovery” (Sicarii) and also listed for Lazarus.

T1082System Information DiscoveryEvidence1

“Discovery T1082 System Information Discovery” (Sicarii) and also listed for Lazarus.

T1083File and Directory DiscoveryEvidence1

“Discovery T1083 File and Directory Discovery” (Sicarii) and “Discovery T1083 File and Directory Discovery” (DynoWiper).

T1087Account DiscoveryEvidence1

“Discovery T1087 Account Discovery” (Sicarii).

T1135Network Share DiscoveryEvidence1

“Discovery T1135 Network Share Discovery” (Sicarii).

T1518Software DiscoveryEvidence1

“Discovery T1518 Software Discovery” (Sicarii).

T1614System Location DiscoveryEvidence1

“Discovery T1614 System Location Discovery” and “T1614.001 … System Language” (Sicarii).

Collection

4 techniques

T1005Data from Local SystemEvidence1

“Collection T1005 Data from Local System” (Sicarii) and also listed for Lazarus.

T1056Input CaptureEvidence1

“Credential Access T1056 Input Capture” and “T1056.001 … Keylogging” (Sicarii).

T1074Data StagedEvidence1

“Collection T1074 Data Staged” (Sicarii).

T1114Email CollectionEvidence1

“Collection T1114 Email Collection” (Sicarii).

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

“Command and Control T1071 Application Layer Protocol” (Sicarii) and “Command and control T1071 Application Layer Protocol” (DynoWiper).

T1573Encrypted ChannelEvidence1

“Command and Control T1573 Encrypted Channel” (Sicarii).

Impact

3 techniques

T1485Data DestructionEvidence1

“Impact T1485 Data Destruction” (Sicarii) and “Impact T1485 Data Destruction” (DynoWiper).

T1486Data Encrypted for ImpactEvidence2

“Impact T1486 Data Encrypted for Impact” (Sicarii).

T1489Service StopEvidence1

“Impact T1489 Service Stop” (Sicarii) and also listed for Lazarus impact techniques.

Other

1 technique

T1562Impair DefensesEvidence1

“Defense Evasion T1562 Impair Defenses” and “T1562.001 … Disable or Modify Tools” (Sicarii).

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyfirma newsNews

Jan 30, 2026

Weekly Intelligence Report - 30 January 2026 - CYFIRMA

Ransomware-as-a-service operation active since late 2025 that performs reconnaissance, credential/system/network data collection, data staging/packaging and exfiltration prior to encrypting files (AES-GCM) and appending the .sicarii extension; drops a ransom note (HOW_TO_RECOVER_DATA.html), changes wallpaper, and deploys a destructive startup batch script (destruct.bat) intended to corrupt boot components and wipe disks to increase coercion.

security online infoNews

Jan 16, 2026

A United Front: Nintendo, Sony, and Microsoft Update Shared Safety Principles

Next:Sicarii Ransomware Masquerades as Israeli Hacktivists

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping33

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Sicarii ransomware