sicarii is a ransomware operator currently active on public leak sites. Darkfield has indexed 1 public victims claimed by this operator between January 5, 2026. The Sicarii ransomware group is an emerging threat actor that first appeared in January 2026, operating with apparent financial motivations based on their ransomware deployment activities. Limited public documentation exists regarding this group's origin or potential affiliations, though their operational patterns suggest they may be operating independently rather than as part of an established ransomware-as-a-service ecosystem. The group's attack methodology remains largely undocumented by major security firms and government agencies, with insufficient public reporting to establish their preferred initial access vectors, encryption techniques, or whether they employ data exfiltration tactics commonly seen in double or triple extortion schemes. Their targeting appears focused primarily on the United States manufacturing sector, though with only one documented victim as of current reporting, their campaign scope and impact remain minimal compared to established ransomware operations. The group's current operational status suggests they are either newly active or operating at a very limited scale, with no significant law enforcement actions or major security researcher attention documented in public threat intelligence reporting.

Recent disclosures by sicarii

All 1 indexed disclosures. Click any row for the full per-victim dossier.

• Triad PackagingManufacturing · United States · January 5, 2026

See every disclosure indexed for sicarii →