Sicarii Ransomware: Truth vs Myth

Description

A new RaaS operation called Sicarii emerged in late 2025, claiming Israeli/Jewish affiliation. The group uses Hebrew language, historical symbols, and right-wing ideological references in its branding. However, underground activity is primarily conducted in Russian, and the Hebrew content appears non-native. The ransomware's technical capabilities include data exfiltration, credential collection, and file encryption. It performs geo-fencing to avoid Israeli systems. The group's behavior and messaging diverge from typical ransomware practices, raising questions about its true identity and motives. Linguistic analysis and operational patterns suggest the claimed Israeli identity may be performative rather than genuine.