sicarii Ransomware
Tracked since Dec 30, 2025
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Sicarii is a pro-Israeli/Jewish-branded ransomware-as-a-service operation that emerged in late 2025, explicitly targeting Arab and Muslim-majority organizations while avoiding Israeli systems, exploiting exposed RDP services and Fortinet devices, with its admin later instructing operators to migrate to the BQTLock platform.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1566 PhishingT1566.001 Phishing: Spearphishing AttachmentT1566.002 Phishing: Spearphishing LinkT1566.003 Phishing: Spearphishing Voice Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled Task/Job: Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 Command and Scripting Interpreter: PowerShellT1059.003 Command and Scripting Interpreter: Windows Command ShellT1059.005 Command and Scripting Interpreter: Visual BasicT1106 Native APIT1129 Shared ModulesT1203 Exploitation for Client ExecutionT1204 User ExecutionT1204.001 User Execution: Malicious LinkT1204.002 User Execution: Malicious File Persistence
T1098 Account ManipulationT1505.004 Server Software Component: IIS ComponentsT1542.003 Pre-OS Boot: BootkitT1543.003 Create or Modify System Process: Windows ServiceT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderT1547.009 Boot or Logon Autostart Execution: Shortcut ModificationT1574.001 Hijack Execution Flow: DLL Search Order Hijacking Privilege Escalation
T1068 Exploitation for Privilege EscalationT1134 Access Token ManipulationT1134.002 Access Token Manipulation: Create Process with TokenT1543 Create or Modify System Process Defense Evasion
T1027 Obfuscated Files or InformationT1027.002 Obfuscated Files or Information: Software PackingT1027.005 Obfuscated Files or Information: Indicator Removal from ToolsT1027.007 Obfuscated Files or Information: Dynamic API ResolutionT1027.009 Obfuscated Files or Information: Embedded PayloadsT1027.013 Obfuscated Files or Information: Encrypted/Encoded FileT1036 MasqueradingT1036.003 Masquerading: Rename Legitimate UtilitiesT1036.004 Masquerading: Masquerade Task or ServiceT1036.005 Masquerading: Match Legitimate Name or LocationT1036.008 Masquerading: Masquerade File TypeT1055.001 Process Injection: DLL InjectionT1070 Indicator RemovalT1070.003 Indicator Removal: Clear Command HistoryT1070.004 Indicator Removal: File DeletionT1070.006 Indicator Removal: TimestompT1140 Deobfuscate/Decode Files or InformationT1202 Indirect Command ExecutionT1218 System Binary Proxy ExecutionT1218.005 System Binary Proxy Execution: MshtaT1218.010 System Binary Proxy Execution: Regsvr32T1218.011 System Binary Proxy Execution: Rundll32T1220 XSL Script ProcessingT1221 Template InjectionT1222 File and Directory Permissions ModificationT1497.001 Virtualization/Sandbox Evasion: System ChecksT1497.003 Virtualization/Sandbox Evasion: Time Based ChecksT1548 Abuse Elevation Control MechanismT1553.002 Subvert Trust Controls: Code SigningT1562 Impair DefensesT1562.001 Impair Defenses: Disable or Modify ToolsT1562.004 Impair Defenses: Disable or Modify System FirewallT1564.001 Hidden Artifacts: Hidden Files and DirectoriesT1574.013 Hijack Execution Flow: KernelCallbackTableT1620 Reflective DLL InjectionT1622 Debugger Evasion Credential Access
T1003 OS Credential DumpingT1056 Input CaptureT1056.001 Input Capture: KeyloggingT1110.003 Brute Force: Password SprayingT1539 Steal Web Session CookieT1552 Unsecured CredentialsT1552.001 Unsecured Credentials: Credentials In FilesT1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning Discovery
T1007 System Service DiscoveryT1010 Application Window DiscoveryT1012 Query RegistryT1016 System Network Configuration DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087 Account DiscoveryT1087.002 Account Discovery: Domain AccountT1124 Time DiscoveryT1135 Network Share DiscoveryT1518 Software DiscoveryT1614 System Location DiscoveryT1614.001 System Location Discovery: System Language Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin SharesT1021.004 Remote Services: SSHT1534 Internal Spearphishing Collection
T1005 Data from Local SystemT1074 Data StagedT1074.001 Data Staged: Local Data StagingT1114 Email CollectionT1560 Archive Collected DataT1560.001 Archive Collected Data: Archive via UtilityT1560.002 Archive Collected Data: Archive via LibraryT1560.003 Archive Collected Data: Archive via Custom Method Exfiltration
T1041 Exfiltration Over C2 ChannelT1048.003 Exfiltration Over Alternative Protocol: Unencrypted Non-C2 ProtocolT1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1001.003 Data Obfuscation: Protocol or Service ImpersonationT1008 Fallback ChannelsT1071 Application Layer ProtocolT1071.001 Application Layer Protocol: Web ProtocolsT1090.001 Proxy: Internal ProxyT1090.002 Proxy: External ProxyT1102.002 Web Service: Bidirectional CommunicationT1104 Multi-Stage ChannelsT1105 Ingress Tool TransferT1132.001 Data Encoding: Standard EncodingT1571 Non-Standard PortT1573 Encrypted ChannelT1573.001 Encrypted Channel: Symmetric Cryptography Impact
T1485 Data DestructionT1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System RecoveryT1491.001 Defacement: Internal DefacementT1529 System Shutdown/RebootT1561 Disk WipeT1561.001 Disk Wipe: Disk Content WipeT1561.002 Disk Wipe: Disk Structure Wipe Resource Development
T1583.001 Acquire Infrastructure: DomainsT1583.004 Acquire Infrastructure: ServerT1583.006 Acquire Infrastructure: Web ServicesT1584.001 Compromise Infrastructure: DomainsT1584.004 Compromise Infrastructure: ServerT1585.001 Establish Accounts: Social Media AccountsT1585.002 Establish Accounts: Email AccountsT1587.001 Develop Capabilities: MalwareT1587.002 Develop Capabilities: Code Signing CertificatesT1588.002 Obtain Capabilities: ToolT1588.003 Obtain Capabilities: Code Signing CertificatesT1588.004 Obtain Capabilities: Digital CertificatesT1608.001 Stage Capabilities: Upload MalwareT1608.002 Stage Capabilities: Upload Tool Reconnaissance
T1589.002 Gather Victim Identity Information: Email AddressesT1591 Gather Victim Org InformationT1591.004 Gather Victim Org Information: Identify RolesT1593.001 Search Open Websites/Domains: Social Media Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live