sicarii is a ransomware operator currently active on public leak sites. Darkfield has indexed 1 public victims claimed by this operator between January 5, 2026. The Sicarii ransomware group is an emerging threat actor that first appeared in January 2026, operating with apparent financial motivations based on their ransomware deployment activities. Limited public documentation exists regarding this group's origin or potential affiliations, though their operational patterns suggest they may be operating independently rather than as part of an established ransomware-as-a-service ecosystem. The group's attack methodology remains largely undocumented by major security firms and government agencies, with insufficient public reporting to establish their preferred initial access vectors, encryption techniques, or whether they employ data exfiltration tactics commonly seen in double or triple extortion schemes. Their targeting appears focused primarily on the United States manufacturing sector, though with only one documented victim as of current reporting, their campaign scope and impact remain minimal compared to established ransomware operations. The group's current operational status suggests they are either newly active or operating at a very limited scale, with no significant law enforcement actions or major security researcher attention documented in public threat intelligence reporting.
How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.