Sicarii is a newly observed RaaS operation that surfaced in late 2025 and has only published 1 claimed victim. The group explicitly brands itself as Israeli/Jewish, using Hebrew language, historical symbols, and extremist right-wing ideological references not usually seen in financially-motivated ransomware operations. Underground online activity associated with Sicarii is primarily conducted in Russian, including RaaS recruitment posts and forum engagement. Hebrew content used by the group appears to be machine-translated or non-native and contains grammatical and semantic errors. The group’s behavior and messaging diverge from established ransomware practices and raise the possibility of identity manipulation or influence-oriented signaling, rather than a real and mature criminal…