Loading story…
Researchers at Halcyon’s Ransomware Research Center (RRC) reported that the emerging Sicarii ransomware has a critical implementation flaw that prevents successful decryption, even if victims pay. Sicarii is being promoted as a ransomware-as-a-service (RaaS) offering on underground forums, but Halcyon’s analysis indicates its encryption design is fundamentally unrecoverable, making it an unusually destructive threat compared with typical ransomware where decryption is at least theoretically possible.
The issue stems from RSA key mishandling: on execution, the malware generates a fresh RSA key pair locally, uses it to encrypt data, and then discards the private key, meaning encryption is not linked to any recoverable master key. As a result, victims have no viable decryption path and attacker-supplied decryptors are ineffective; Halcyon explicitly advised organizations not to pay a Sicarii ransom because payment cannot improve recovery outcomes. Both reports note Halcyon’s assessment that the defect may reflect low-skill development and possible over-reliance on AI-assisted “vibe coding,” and one report highlights Sicarii’s “Hebrew” branding as potentially a false flag rather than a reliable attribution signal.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Following publication of the technical analysis, researchers and incident responders advised organizations affected by Sicarii to avoid assuming payment will restore data and instead prioritize backups, isolation, forensics, scoping, and experienced incident-response support. Halcyon noted that decryption failures this severe are rare in ransomware operations.
Check Point Research found that although Sicarii presents itself with Hebrew language, Jewish symbols, and an Israeli persona, its operational activity is primarily in Russian and the Hebrew content appears machine-translated. This raised the possibility that the branding is a false-flag identity rather than a genuine attribution signal.
Halcyon’s Ransomware Research Center reported that the emerging Sicarii ransomware generates a new RSA key pair on each execution, encrypts files, and discards the private key, making attacker-supplied decryptors ineffective. The finding means victims may be unable to recover encrypted data even if they pay a ransom.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Sicarii**, a newly observed ransomware-as-a-service (RaaS) operation that surfaced in late 2025, has drawn attention for unusually explicit Israel/Jewish-themed branding and malware behavior that appears designed to *avoid* Israeli targets. Reporting indicates the group claims to focus on organizations in Arab and Muslim countries while implementing **geo-fencing** checks (e.g., time zone, keyboard layout, and IP-based indicators) to prevent execution on systems identified as Israeli—an uncommon choice for financially motivated ransomware and one that reduces plausible deniability. Check Point notes Sicarii has publicly claimed only **one victim** so far, and that its underground activity is largely conducted in **Russian**, while the Hebrew content appears error-prone and potentially machine-translated, raising the possibility of identity manipulation or influence-oriented signaling rather than a mature criminal operation. Technical analysis describes Sicarii’s execution flow as including anti-analysis/anti-virtualization behavior, staging itself under a temporary-path filename like `svchost_{random}.exe`, and performing connectivity checks (e.g., repeated requests to `google.com/generate_204`) before conducting aggressive network reconnaissance. Check Point further attributes capabilities including **data exfiltration**, credential and network information collection, and attempts to exploit **Fortinet** devices, with file encryption reported as **AES-GCM** and appending the `.sicarii` extension. Separate reporting on **DragonForce** ransomware (including a decryptor for Windows/ESXi) is unrelated to Sicarii and does not describe the same operation or incident.
Jun 29, 2026
Researchers analyzed **HildaCrypt**, a Windows ransomware family written in C# that was distributed as a fake XAMPP installer named `xamp.exe` and obfuscated with **ConfuserEx**. Once launched, it created a GUID-named folder under `%AppData%\Roaming%`, ran a batch script, deleted shadow copies, and attempted to stop SQL, backup, and anti-malware services before encrypting files. The malware used **AES-256-CBC** for file encryption, appended the `.HCY!` extension, and stored the AES key and IV in each file after encrypting them with an embedded **RSA-2048** public key; it then dropped an HTML ransom note, `HILDACRYPTReadMe.html`, directing victims to contact the operator by email. A separate development reduced the threat to victims after the ransomware’s developer released HildaCrypt’s master private decryption keys. Researcher **GrujaRS** had initially classified a sample as a STOP ransomware variant, but the author later said it was a HildaCrypt variant, and **Michael Gillespie** confirmed the keys were valid and published a working decryptor. The developer claimed the malware was created for “fun” and educational purposes, said it had not been used against anyone, and indicated development was likely ending as they moved toward legitimate cybersecurity work.
Aug 15, 2026
Security researchers said companies claiming to decrypt files locked by **Dharma/Crisis ransomware** are not defeating the malware’s encryption, which experts described as effectively unbreakable without a flaw or the criminals’ private key. An investigation by Emsisoft and outside researchers challenged Australian firm **Fast Data Recovery** after it advertised a high chance of recovering Dharma-encrypted files and claimed it could reverse engineer decryption keys, despite specialists including Brett Callow, Michael Gillespie, Bill Siegel, and Fabian Wosar saying no such capability is known to exist. Separate research by Check Point found that Russian service **Dr. Shifro** allegedly operated as a broker between victims and ransomware operators, buying decryption keys at a discount and reselling recovery at a markup rather than performing true cryptographic recovery. In a sting operation, Check Point observed the service requesting encrypted samples and then contacting the attacker-side email to negotiate key purchases; the researchers linked the activity to **iharauch@gmail.com** and identified a likely operator in Moscow, estimating profits of about **$1,350 per victim** and potentially hundreds of thousands of dollars overall.
Aug 15, 2026