Sicarii Ransomware
TrackedThreat actor group tracked in the global ransomware database · Last disclosure: Jan 5, 2026
ThreatAI Analysis
Compiled from the ransomware.live profile for Sicarii and from this database. Figures and technique mappings are quoted from the source data, not inferred.
Who Sicarii is
Sicarii is a pro-Israeli/Jewish-branded ransomware-as-a-service operation that emerged in late 2025, explicitly targeting Arab and Muslim-majority organizations while avoiding Israeli systems, exploiting exposed RDP services and Fortinet devices, with its admin later instructing operators to migrate to the BQTLock platform.
Recorded activity
Disclosures attributed to Sicarii in this database run from January 2026 to January 2026, totalling 1 victims — 0% of everything tracked here. Sicarii has listed victims in 1 countries in this database, most often United States. The sectors appearing most in its listings are Manufacturing.
How Sicarii is documented to operate
Valid Accounts T1078 Stealth Persistence
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network.
Mitigations: Application Developer Guidance, User Training, Password Policies, User Account Management, Privileged Account Management, Multi-factor Authentication
MITRE ATT&CK reference →Drive-by Compromise T1189 Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: A legitimate website is compromised, allowing adversaries to inject malicious code Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may als…
Mitigations: Restrict Web-Based Content, User Training, Application Isolation and Sandboxing, Exploit Protection, Update Software
MITRE ATT&CK reference →Exploit Public-Facing Application T1190 Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers.
Mitigations: Vulnerability Scanning, Limit Access to Resource Over Network, Filter Network Traffic, Network Segmentation, Privileged Account Management, Application Isolation and Sandboxing
MITRE ATT&CK reference →Phishing T1566 Initial Access
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms.
Mitigations: Network Intrusion Prevention, Restrict Web-Based Content, User Training, Antivirus/Antimalware, Software Configuration, Audit
MITRE ATT&CK reference →Windows Management Instrumentation T1047 Execution
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model and Windows Remote Management. Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Mitigations: Execution Prevention, Behavior Prevention on Endpoint, User Account Management, Privileged Account Management
MITRE ATT&CK reference →Command and Scripting Interpreter T1059 Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.
Mitigations: Restrict Web-Based Content, Limit Software Installation, Execution Prevention, Code Signing, Behavior Prevention on Endpoint, Privileged Account Management
MITRE ATT&CK reference →MITRE ATT&CK techniques attributed to Sicarii across its recorded activity. They describe the group overall, not any single incident.
YARA detection rules
sicarii.yar
/*
sicarii ransomware
*/
rule sicarii_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.sicarii"
description = "Detects sicarii ransomware ransom note or artifact"
date = "2026-05-04"
severity = 7
score = 70
strings:
$name1 = "sicarii" ascii nocase
$name2 = "SICARII" ascii
$onion = "sicarii.onion" ascii nocase
condition:
any of them
}Community-contributed rules for Sicarii, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.
Threat Actor Analysis
Sicarii is a ransomware threat group that has disclosed 1 victims in publicly accessible leak site data, representing 0% of all ransomware attacks tracked in this database. The earliest victim disclosure attributed to Sicarii in our dataset dates to January 2026.
Geographically, Sicarii has targeted organisations in 1 countries. The most frequently targeted nation is United States with 1 victim organisations.
Industry-wise, Sicarii shows a concentration in the Manufacturing sector. These industries are frequently targeted because they manage sensitive data, critical operations, or have lower tolerance for operational downtime — conditions that increase ransom payment likelihood.
Like most modern ransomware operations, Sicarii likely employs a double extortion model: encrypting victim files while simultaneously exfiltrating data, creating dual pressure to pay the ransom. Victim organisations that refuse payment face having their data published on the group's dark web leak site.
Note: This profile is generated from public leak site disclosures aggregated via the ransomware.live API. Data is updated automatically. The table below lists the 1 most recent of the 1 disclosures we hold for this group; use the link beneath it to page through all of them.
Recent Victim Disclosures (showing 1 of 1)
| # | Organization | Country | Sector | Date |
|---|---|---|---|---|
| 1 | Triad Packaging triadpkg.com | 🇺🇸 United States | Manufacturing | Jan 5, 2026 |
Frequently Asked Questions
What is Sicarii ransomware?
Sicarii is a ransomware threat group that has claimed 1 victims since its first known activity in January 2026. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.
How many victims has Sicarii attacked?
Sicarii has claimed 1 victims in our database, representing 0% of all tracked ransomware attacks. The most targeted countries are United States.
Which countries does Sicarii target?
Sicarii has attacked organizations in 1 countries. The top targeted countries are: United States.
Which industries does Sicarii target?
Sicarii most frequently targets the Manufacturing sectors based on victim disclosures in our database.
Is Sicarii still active?
Sicarii's most recent victim disclosure in our database was on January 5, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.