Início / Ransomware Intelligence / Todos os grupos / sicarii

sicarii Ransomware

🔔 Criar alerta

Monitorado desde 30/12/2025

0

vítimas registradas

0

nos últimos 30 dias

0

CVEs

—

Última atividade

Sicarii is a pro-Israeli/Jewish-branded ransomware-as-a-service operation that emerged in late 2025, explicitly targeting Arab and Muslim-majority organizations while avoiding Israeli systems, exploiting exposed RDP services and Fortinet devices, with its admin later instructing operators to migrate to the BQTLock platform.

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

Nenhuma CVE associada a este grupo nas fontes.

Táticas e técnicas (MITRE ATT&CK)

Initial Access

T1078 Valid Accounts T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1566 Phishing T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing Link T1566.003 Phishing: Spearphishing Voice

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task/Job: Scheduled Task T1059 Command and Scripting Interpreter T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1059.005 Command and Scripting Interpreter: Visual Basic T1106 Native API T1129 Shared Modules T1203 Exploitation for Client Execution T1204 User Execution T1204.001 User Execution: Malicious Link T1204.002 User Execution: Malicious File

Persistence

T1098 Account Manipulation T1505.004 Server Software Component: IIS Components T1542.003 Pre-OS Boot: Bootkit T1543.003 Create or Modify System Process: Windows Service T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.009 Boot or Logon Autostart Execution: Shortcut Modification T1574.001 Hijack Execution Flow: DLL Search Order Hijacking

Privilege Escalation

T1068 Exploitation for Privilege Escalation T1134 Access Token Manipulation T1134.002 Access Token Manipulation: Create Process with Token T1543 Create or Modify System Process

Defense Evasion

T1027 Obfuscated Files or Information T1027.002 Obfuscated Files or Information: Software Packing T1027.005 Obfuscated Files or Information: Indicator Removal from Tools T1027.007 Obfuscated Files or Information: Dynamic API Resolution T1027.009 Obfuscated Files or Information: Embedded Payloads T1027.013 Obfuscated Files or Information: Encrypted/Encoded File T1036 Masquerading T1036.003 Masquerading: Rename Legitimate Utilities T1036.004 Masquerading: Masquerade Task or Service T1036.005 Masquerading: Match Legitimate Name or Location T1036.008 Masquerading: Masquerade File Type T1055.001 Process Injection: DLL Injection T1070 Indicator Removal T1070.003 Indicator Removal: Clear Command History T1070.004 Indicator Removal: File Deletion T1070.006 Indicator Removal: Timestomp T1140 Deobfuscate/Decode Files or Information T1202 Indirect Command Execution T1218 System Binary Proxy Execution T1218.005 System Binary Proxy Execution: Mshta T1218.010 System Binary Proxy Execution: Regsvr32 T1218.011 System Binary Proxy Execution: Rundll32 T1220 XSL Script Processing T1221 Template Injection T1222 File and Directory Permissions Modification T1497.001 Virtualization/Sandbox Evasion: System Checks T1497.003 Virtualization/Sandbox Evasion: Time Based Checks T1548 Abuse Elevation Control Mechanism T1553.002 Subvert Trust Controls: Code Signing T1562 Impair Defenses T1562.001 Impair Defenses: Disable or Modify Tools T1562.004 Impair Defenses: Disable or Modify System Firewall T1564.001 Hidden Artifacts: Hidden Files and Directories T1574.013 Hijack Execution Flow: KernelCallbackTable T1620 Reflective DLL Injection T1622 Debugger Evasion

Credential Access

T1003 OS Credential Dumping T1056 Input Capture T1056.001 Input Capture: Keylogging T1110.003 Brute Force: Password Spraying T1539 Steal Web Session Cookie T1552 Unsecured Credentials T1552.001 Unsecured Credentials: Credentials In Files T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning

Discovery

T1007 System Service Discovery T1010 Application Window Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087 Account Discovery T1087.002 Account Discovery: Domain Account T1124 Time Discovery T1135 Network Share Discovery T1518 Software Discovery T1614 System Location Discovery T1614.001 System Location Discovery: System Language Discovery

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares T1021.004 Remote Services: SSH T1534 Internal Spearphishing

Collection

T1005 Data from Local System T1074 Data Staged T1074.001 Data Staged: Local Data Staging T1114 Email Collection T1560 Archive Collected Data T1560.001 Archive Collected Data: Archive via Utility T1560.002 Archive Collected Data: Archive via Library T1560.003 Archive Collected Data: Archive via Custom Method

Exfiltration

T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Alternative Protocol: Unencrypted Non-C2 Protocol T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Command and Control

T1001.003 Data Obfuscation: Protocol or Service Impersonation T1008 Fallback Channels T1071 Application Layer Protocol T1071.001 Application Layer Protocol: Web Protocols T1090.001 Proxy: Internal Proxy T1090.002 Proxy: External Proxy T1102.002 Web Service: Bidirectional Communication T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1132.001 Data Encoding: Standard Encoding T1571 Non-Standard Port T1573 Encrypted Channel T1573.001 Encrypted Channel: Symmetric Cryptography

Impact

T1485 Data Destruction T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1491.001 Defacement: Internal Defacement T1529 System Shutdown/Reboot T1561 Disk Wipe T1561.001 Disk Wipe: Disk Content Wipe T1561.002 Disk Wipe: Disk Structure Wipe

Resource Development

T1583.001 Acquire Infrastructure: Domains T1583.004 Acquire Infrastructure: Server T1583.006 Acquire Infrastructure: Web Services T1584.001 Compromise Infrastructure: Domains T1584.004 Compromise Infrastructure: Server T1585.001 Establish Accounts: Social Media Accounts T1585.002 Establish Accounts: Email Accounts T1587.001 Develop Capabilities: Malware T1587.002 Develop Capabilities: Code Signing Certificates T1588.002 Obtain Capabilities: Tool T1588.003 Obtain Capabilities: Code Signing Certificates T1588.004 Obtain Capabilities: Digital Certificates T1608.001 Stage Capabilities: Upload Malware T1608.002 Stage Capabilities: Upload Tool

Reconnaissance

T1589.002 Gather Victim Identity Information: Email Addresses T1591 Gather Victim Org Information T1591.004 Gather Victim Org Information: Identify Roles T1593.001 Search Open Websites/Domains: Social Media

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live