Sicarii Ransomware: Truth vs Myth

Sicarii is a newly observed RaaS operation that surfaced in late 2025 and has only published 1 claimed victim. The group explicitly brands itself as Israeli/Jewish, using Hebrew language, historical symbols, and extremist references not usually seen in financially motivated ransomware. Underground activity associated with Sicarii is primarily conducted in Russian, including RaaS recruitment posts and forum engagement, while Hebrew content appears machine-translated or non-native with grammatical errors.

The operation’s branding and messaging diverge from ransomware norms and suggest identity manipulation or influence-oriented signalling rather than a mature criminal enterprise. Technical analysis shows the ransomware performs an active geo‑fencing check to avoid Israeli systems, exfiltrates data and collects credentials, exploits Fortinet devices (CVE-2025-64446), and encrypts files with AES-GCM, appending the .sicarii extension.

Public and private communications include self-reported victim counts and comparisons to Russian groups like LockBit and Qilin, but the first publicly listed victim appeared on 5 January 2026, described as a Greece-based manufacturer. The release of a rudimentary leak site, linguistic inconsistencies in Hebrew, and signs of centralised, early‑stage tooling all point to limited operational maturity and possible performative signalling rather than a proven, mature RaaS ecosystem.