Icarus
Icarus is a ransomware group with a financial motive, tracked by Brandefense. It targets 5 sectors, including Government and Technology, in 3 countries, including the United States and Canada. It uses 9 MITRE ATT&CK techniques.
- Techniques
- 9
- Exploited CVEs
- No CVE data
- First seen
- May 5, 2026
- Last seen
- Jun 23, 2026
- Record updated
Who They Target.
Countries · 3
Labelsbdef-qf:latest
About Icarus.
A data extortion actor that emerged in open sources in April 2026 and is tracked within the ransomware monitoring ecosystem. Icarus prioritizes data theft, leak-site pressure, and extortion via email and encrypted messaging over conventional file encryption, with a strongest-known operation abusing SaaS integrations and OAuth tokens.
Last updated Sep 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.