Sicarii
Since Jan 5, 2026, Sicarii has listed 1 organizations on its leak site.
Listings per month
- Total listings
- 1
- First listing
- Jan 5, 2026
- Latest listing
- Jan 5, 2026
- MITRE ATT&CK techniques
- 60
Sicarii is a pro-Israeli/Jewish-branded ransomware-as-a-service operation that emerged in late 2025, explicitly targeting Arab and Muslim-majority organizations while avoiding Israeli systems, exploiting exposed RDP services and Fortinet devices, with its admin later instructing operators to migrate to the BQTLock platform.
It posted 1 listings in the last 12 months; the busiest month was January 2026 (1 listings).
Most targeted country: United States, with 1 listings (100% of the total).
Most targeted sector: Manufacturing, with 1 listings (100% of the total).
Targeted countries
Targeted sectors
Showing 1 of 1 results
60 MITRE ATT&CK techniques across 5 stages are documented in the group's attacks.
- 1
Initial access
The attacker gets into the corporate network for the first time.
T1078Valid AccountsT1189Drive-by CompromiseT1190Exploit Public-Facing ApplicationT1566PhishingT1566.001Phishing: Spearphishing AttachmentT1566.002Phishing: Spearphishing LinkT1566.003Phishing: Spearphishing Voice - 2
Execution
Malicious code runs on the target system.
T1047Windows Management InstrumentationT1053.005Scheduled Task/Job: Scheduled TaskT1059Command and Scripting InterpreterT1059.001Command and Scripting Interpreter: PowerShellT1059.003Command and Scripting Interpreter: Windows Command ShellT1059.005Command and Scripting Interpreter: Visual BasicT1106Native APIT1129Shared ModulesT1203Exploitation for Client ExecutionT1204User ExecutionT1204.001User Execution: Malicious LinkT1204.002User Execution: Malicious File - 3
Persistence
Access survives reboots and password changes.
T1098Account ManipulationT1505.004Server Software Component: IIS ComponentsT1542.003Pre-OS Boot: BootkitT1543.003Create or Modify System Process: Windows ServiceT1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderT1547.009Boot or Logon Autostart Execution: Shortcut ModificationT1574.001Hijack Execution Flow: DLL Search Order Hijacking - 4
Privilege escalation
The attacker moves to accounts with higher privileges.
T1068Exploitation for Privilege EscalationT1134Access Token ManipulationT1134.002Access Token Manipulation: Create Process with TokenT1543Create or Modify System Process - 5
Defense evasion
Security software and logging are bypassed.
T1027Obfuscated Files or InformationT1027.002Obfuscated Files or Information: Software PackingT1027.005Obfuscated Files or Information: Indicator Removal from ToolsT1027.007Obfuscated Files or Information: Dynamic API ResolutionT1027.009Obfuscated Files or Information: Embedded PayloadsT1027.013Obfuscated Files or Information: Encrypted/Encoded FileT1036MasqueradingT1036.003Masquerading: Rename Legitimate UtilitiesT1036.004Masquerading: Masquerade Task or ServiceT1036.005Masquerading: Match Legitimate Name or LocationT1036.008Masquerading: Masquerade File TypeT1055.001Process Injection: DLL InjectionT1070Indicator RemovalT1070.003Indicator Removal: Clear Command HistoryT1070.004Indicator Removal: File DeletionT1070.006Indicator Removal: TimestompT1140Deobfuscate/Decode Files or InformationT1202Indirect Command ExecutionT1218System Binary Proxy ExecutionT1218.005System Binary Proxy Execution: MshtaT1218.010System Binary Proxy Execution: Regsvr32T1218.011System Binary Proxy Execution: Rundll32T1220XSL Script ProcessingT1221Template InjectionT1222File and Directory Permissions ModificationT1497.001Virtualization/Sandbox Evasion: System ChecksT1497.003Virtualization/Sandbox Evasion: Time Based ChecksT1548Abuse Elevation Control MechanismT1553.002Subvert Trust Controls: Code SigningT1562Impair Defenses
What does a ransomware group do?
Ransomware groups break into corporate networks, move data out and encrypt systems. If the ransom is not paid, they list the organization on a leak site and threaten to publish the data.
How does Sicarii get into organizations?
The attacker gets into the corporate network for the first time.
- T1078 · Valid Accounts
- T1189 · Drive-by Compromise
- T1190 · Exploit Public-Facing Application
- T1566 · Phishing
- T1566.001 · Phishing: Spearphishing Attachment
- T1566.002 · Phishing: Spearphishing Link
- T1566.003 · Phishing: Spearphishing Voice
Which defenses matter most?
Priority defenses based on the documented techniques:
- Keep internet-facing VPN, remote desktop and firewall interfaces patched, and require multi-factor authentication on these accounts.
- Allow scripts and macros only for users who need them, and keep behavioral rules enabled in endpoint protection.
- Monitor newly created services, scheduled tasks and startup entries.
- Reduce local administrator accounts and perform privileged tasks from separate, monitored accounts.
- Alert when security software is disabled or logs are cleared.
What should you do if your organization is listed on a leak site?
- Record the listing and any published sample files; do not visit the leak site from the corporate network.
- Isolate affected systems and preserve logs without deleting them.
- Determine which data left the organization; if personal data is involved, review notification obligations with your legal team.
- Make any decision about the ransom demand together with legal, management and incident response.
- Do not bring systems back online before the attacker’s entry point is closed.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainIntelligence 360
Customer intelligence on top of Infostealer Detection: leaked accounts of end users who sign in to your site.