Sicarii
Sicarii is a ransomware group with a financial motive, tracked by Brandefense. It targets the Manufacturing sector in the United States. It uses 42 MITRE ATT&CK techniques and exploits 1 known CVE.
- Techniques
- 42
- Exploited CVEs
- 1
- First seen
- Oct 25, 2025
- Last seen
- Feb 28, 2026
- Record updated
Who They Target.
Sectors · 1
Countries · 1
About Sicarii.
Sicarii is a pro-Israeli/Jewish-branded ransomware-as-a-service operation that emerged in late 2025, explicitly targeting Arab and Muslim-majority organizations while avoiding Israeli systems, exploiting exposed RDP services and Fortinet devices, with its admin later instructing operators to migrate to the BQTLock platform.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.