Sicarii is a Ransomware-as-a-Service (RaaS) operation that first emerged in December 2025, distinguishing itself through its explicit Israeli and Jewish branding, including Hebrew language and symbols like the Haganah emblem. While outwardly presenting an ideological motivation with claims of targeting Arab or Muslim states, evidence suggests this is a false-flag operation, as the group's underground activity is primarily conducted in Russian and Hebrew content appears machine-translated or non-native, indicating Russian-speaking operators. The group's primary motivation is financial, achieved through double extortion tactics involving data exfiltration and file encryption. A unique and critical characteristic setting Sicarii apart is a fundamental flaw in its ransomware's encryption process; it generates new RSA key pairs for each execution and immediately discards the private key, rendering encrypted data permanently unrecoverable even if a ransom payment is made.

Aliases del actor

The Sicari Knife

Actores similares

thegentlemenransomware · 504other-actorsactor · 72the-gentlemenactor · 70brotherhoodransomware · 3againstthewestransomware · 2leaktheanalystransomware · 2prometheusransomware · 2thegreenbloodgroupransomware · 2the-green-blood-groupactor · 2TheGentlemenactor · 1

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker