Loading story…
Sicarii, a newly observed ransomware-as-a-service (RaaS) operation that surfaced in late 2025, has drawn attention for unusually explicit Israel/Jewish-themed branding and malware behavior that appears designed to avoid Israeli targets. Reporting indicates the group claims to focus on organizations in Arab and Muslim countries while implementing geo-fencing checks (e.g., time zone, keyboard layout, and IP-based indicators) to prevent execution on systems identified as Israeli—an uncommon choice for financially motivated ransomware and one that reduces plausible deniability. Check Point notes Sicarii has publicly claimed only one victim so far, and that its underground activity is largely conducted in Russian, while the Hebrew content appears error-prone and potentially machine-translated, raising the possibility of identity manipulation or influence-oriented signaling rather than a mature criminal operation.
Technical analysis describes Sicarii’s execution flow as including anti-analysis/anti-virtualization behavior, staging itself under a temporary-path filename like svchost_{random}.exe, and performing connectivity checks (e.g., repeated requests to google.com/generate_204) before conducting aggressive network reconnaissance. Check Point further attributes capabilities including data exfiltration, credential and network information collection, and attempts to exploit Fortinet devices, with file encryption reported as AES-GCM and appending the .sicarii extension. Separate reporting on DragonForce ransomware (including a decryptor for Windows/ESXi) is unrelated to Sicarii and does not describe the same operation or incident.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
On January 14, 2026, Check Point Research published an assessment concluding Sicarii had real extortion capability but showed anomalies suggesting immaturity, centralized development, or possible false-flag signaling. The report noted Russian- and English-language underground activity, non-native or machine-translated Hebrew, low OpSec, and inconclusive attribution.
Analysis revealed the malware used anti-VM checks, internet connectivity tests, reconnaissance, RDP scanning, data theft, and persistence mechanisms before encrypting files with the .sicarii extension. Researchers also found lateral movement attempts exploiting Fortinet devices via CVE-2025-64446 and a destructive component that could corrupt boot files and wipe disks.
By late 2025 or early 2026, Sicarii had publicly listed a Greece-based manufacturer as its first claimed victim. The operator later described this victim as 'just a test,' creating inconsistencies around the group’s claims and maturity.
In late December 2025, Sicari/Sicarii ransomware activity was observed and documented as a low-prevalence crypto-ransomware family using AES and RSA encryption against business users. The report identified artifacts including the README_SICARII_LOCKED.txt ransom note, sicarii_wallpaper.bmp, sample filenames, Tor onion payment sites, and associated file hashes.
As the operation emerged, Sicarii claimed it would target organizations in Arab and Muslim countries while avoiding Israeli systems. Its malware implemented geo-fencing checks based on time zone, Hebrew keyboard layout, and Israeli IP ranges to prevent execution on Israeli hosts.
In December 2025, a new ransomware-as-a-service operation called Sicarii appeared on underground forums and channels. It presented itself with explicit Israeli/Jewish branding, Hebrew language, and ideological symbolism.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 50 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceresearch.checkpoint.com
Open sourceid-ransomware.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **Halcyon’s Ransomware Research Center (RRC)** reported that the emerging **Sicarii** ransomware has a critical implementation flaw that prevents successful decryption, even if victims pay. Sicarii is being promoted as a **ransomware-as-a-service (RaaS)** offering on underground forums, but Halcyon’s analysis indicates its encryption design is fundamentally unrecoverable, making it an unusually destructive threat compared with typical ransomware where decryption is at least theoretically possible. The issue stems from **RSA key mishandling**: on execution, the malware generates a fresh RSA key pair locally, uses it to encrypt data, and then **discards the private key**, meaning encryption is not linked to any recoverable master key. As a result, victims have **no viable decryption path** and attacker-supplied decryptors are ineffective; Halcyon explicitly advised organizations not to pay a Sicarii ransom because payment cannot improve recovery outcomes. Both reports note Halcyon’s assessment that the defect may reflect low-skill development and possible over-reliance on AI-assisted “*vibe coding*,” and one report highlights Sicarii’s “Hebrew” branding as potentially a **false flag** rather than a reliable attribution signal.
Jun 29, 2026
Cyber insurance and threat reporting indicate **ransomware operators are increasingly leaning on data theft and extortion** as organizations improve backup and recovery. Coalition’s 2025 claims data (across 100,000+ policyholders) shows **business email compromise (BEC)** and **funds transfer fraud (FTF)** dominated claims volume, while **ransomware** represented a smaller share but featured **sharply higher initial demands** (average just over **$1.0M**, with some as high as **$16M**) even as average loss severity declined—consistent with improved restoration and response reducing the leverage of pure encryption-only attacks. In parallel, the broader ransomware ecosystem continues to **reorganize rather than shrink** despite sustained law-enforcement disruption of major RaaS brands (e.g., LockBit/Hive/ALPHV), with reporting citing high victim-post volumes across dozens of active operations. Halcyon reported a **tactical shift among pro-Iranian/pro-Palestinian-aligned operators** away from *Sicarii* toward **BQTLock (Baqiyat 313 Locker)**, including promotion of “free” RaaS access via Telegram and targeting focused on the UAE, US, and Israel. Separately, **ShinyHunters** claimed a major theft from AI merchant-data platform *Woflow* (alleging internal data, PII, and transaction/order details) but provided no sample for verification at the time of reporting, while a separate SC Media piece used the **SoundCloud** incident (reported exposure of data tied to ~**29.8M** accounts) to highlight incident-response and crisis-management considerations rather than new technical findings.
Jun 29, 2026
FortiGuard Labs said the **DeathRansom** ransomware campaign is strongly tied to **Vidar** stealer activity and several other malware operations through shared infrastructure, naming conventions, and recurring attribution artifacts. Researchers found Vidar samples attempting to access Bitbucket paths under the profile name **`scat01`** and likely retrieving DeathRansom variants named in the **`Wacatac_YYYY-MM-DD_HH-MM.exe`** format. The same cluster was also linked to **Azorult**, **Evrial stealer**, **1ms0rryStealer**, and **Supreme miner**, with repeated use of identifiers including the nickname **`scat01`**, the email **`vitasa01@yandex.ru`**, and the domain **`gameshack[.]ru`**. FortiGuard assessed that false Slovak and Nepali language artifacts were likely planted to mislead investigators, while other evidence pointed to a Russian-speaking operator associated with the online persona **SoftEgorka** and likely connected to **Egor Nedugov** from the Rostov-on-Don/Aksay area. Separate technical profiling described DeathRansom, also detected in some cases as **Wacatac**, as a ransomware family that evolved from early variants that sometimes only mimicked encryption into later builds that performed real file encryption. The malware primarily targeted English-speaking users, dropped a **`read_me.txt`** ransom note, demanded Bitcoin payment through attacker-controlled email addresses, and checked systems against a whitelist of CIS-region languages before running. Analysts documented multiple delivery paths, including **RDP compromise**, spam, malicious downloads, botnets, exploits, malvertising, fake updates, and trojanized installers, and noted changing cryptographic implementations involving **Curve25519/ECDH**, **Salsa20**, **RSA-2048**, **AES**, and **SHA-256**. The reporting also noted code or family relationships with **EZDZ-Locker**, **TechandStrat**, **HelloKitty**, **FiveHands**, **DCRTR**, and **STOP** ransomware.
Aug 15, 2026