Icarus

Based on available threat intelligence, Icarus is an emerging ransomware group first observed in May 2026 with limited documented activity to date. The group appears to be in early operational stages with only one confirmed victim reported in public security advisories. Icarus has demonstrated targeting focus on Indonesia's financial services sector, suggesting either regional operational preferences or specific expertise in compromising financial institutions within Southeast Asian markets. Due to the group's recent emergence and minimal public reporting from established threat intelligence sources, detailed information regarding their specific attack methodologies, initial access vectors, encryption techniques, or organizational structure remains undocumented by major security research firms or government agencies. No confirmed attribution to specific threat actors, state sponsorship, or connections to established ransomware-as-a-service operations has been reported by CISA, FBI, or leading cybersecurity organizations. The group's current operational status remains unclear given the limited intelligence available, though their recent emergence suggests they may still be active or in developmental phases of their ransomware operations.