Sicarii Ransomware Masquerades as Israeli Hacktivists

Security researchers at Check Point have released an analysis of Sicarii, a Ransomware-as-a-Service group that emerged in late 2025, noting that the group aggressively brands itself as a patriotic Israeli and Jewish organisation, a persona that is likely a sophisticated false flag designed to obscure the true identity of its operators, who appear to be Russian speakers.

The researchers describe Sicarii as a centralized and informal operation with early‑stage tooling, and they report that the group’s branding relies on Hebrew language and extremist right‑wing references, including a geo‑fencing check in the malware to prevent execution on Israeli systems.

Despite the deception, the ransomware is functional and includes data exfiltration, the collection of system credentials and network information, and the ability to exploit Fortinet vulnerabilities, with files encrypted using AES-GCM and appended with the .sicarii extension.

The analysis notes that the group’s underground activity is primarily conducted in Russian and that their recruitment posts for affiliates, along with their Telegram and forum activity, reveal a performative identity signaling rather than genuine ideological motives. According to Check Point, Sicarii’s self‑description should not necessarily be taken at face value, and the branding is best viewed as identity manipulation rather than a reflection of authentic motives.