Alexander Culafi , Senior News Writer , Dark Reading January 27, 2026 4 Min Read Source: Panther Media Global via Alamy Stock Photo Victims hit with the emerging Sicarii ransomware should never opt to pay up: the decryption process doesn't work, likely a result of an unskilled cybercriminal using vibe-coding to create it. Researchers at Halcyon's Ransomware Research Center observed a technical flaw where even if a victim pays, the decryption process fails in such a way where not even the threat actor can fix the issue. Paying the ransom is, of course, not recommended in general, as doing so funds further cybercrime and doesn't necessarily guarantee your data is safe, nor that attackers wouldn't simply exploit you again. Still, it adds insult to injury that even if an organization does decide to pay a ransom demand, their encrypted data will simply stay locked up. Halcyon on Jan. 23 said Sicarii popped up as a ransomware-as-a-service (RaaS) offering last month, with operators advertising it on underground cybercrime forums. Regarding Sicarii's broken decryption process, researchers said that "during execution, the malware regenerates a new RSA key pair locally, uses the newly generated key material for encryption, and then discards the private key." The security alert continued, "This per-execution key generation means encryption is not tied to a recoverable master key, leaving victims without a viable decryption path and making attacker-provided decryptors ineffective for affected systems." Sicarii Malware's Strange Behavior Indicates AI Tooling Check Point Research (CPR), which covered the group earlier in January , said Sicarii "explicitly brands itself as Israeli/Jewish, using Hebrew language, historical symbols, and extremist right-wing ideological references not usually seen in financially-motivated ransomware operations." Despite this, CPR said the malware's online activity is primarily conducted in Russian, and the Hebrew-based content appears machine-translated, or non-native, based on errors. "These indicators raise questions regarding the authenticity of the group's claimed identity and suggest the possibility of performative or false-flag behavior rather than genuine national or ideological alignment," researchers said. According to CPR, as of Jan. 14, an operator posing as communications lead for the ransomware said Sicarii has compromised between three and six victims, all of whom have paid the ransom, and that the group primarily targets small businesses. Because of the unreliability inherent to cybercriminal behavior, it is impossible to say how accurate any of these claims are. In addition, multiple elements of Sicarii's behavior (such as requesting "ransomware APKs" in public group chats) suggest an inexperienced actor. This dovetails with the more recent security alert covering broken decryption processes: "Halcyon assesses with moderate confidence that the developers may have used AI-assisted tooling , which could have contributed to this implementation error." Cynthia Kaiser, senior vice president of the Ransomware Research Center, tells Dark Reading that Halcyon believes AI-assisted tooling could have been used, because the ransomware's code was poorly written, as the nature of the key-handling defect indicates. Asked how often the team sees decryption failures at this level, she says it's quite rare, though unreliable and imperfect decryptors are "not uncommon." "We've seen many cases where decryption required extensive manual intervention or prolonged back and forth with the threat actor, sometimes lasting weeks," she says. "In practice, most groups prefer to reuse proven or leaked ransomware source code rather than building something entirely from scratch, which reduces the risk of catastrophic failures like this." Tammy Harper, senior threat intelligence researcher at Flare, similarly says that this kind of broken decryption isn't common among mature ransomware operations but it's not unheard of — particularly among newer crews or rushed builds. "Historically, when this happens, it’s usually due to poor key management, flawed crypto implementation, or mistakes during refactors," she tells Dark Reading. "What’s different now is the speed at which inexperienced actors can stand up ransomware using copied code or AI-assisted tooling, which increases the likelihood of subtle but catastrophic crypto errors slipping through. Before AI, up-and-coming threat actors would rely on old leaked builders like Conti and LockBit." Sicarii Victims Should Exercise Caution Before Paying The critical takeaway for an organization that has been compromised by Sicarii is to be careful before considering a ransom payment of any kind. Halcyon's post expressed as much, saying organizations impacted should assume ransom payment will not restore encrypted data, "unless there is independent confirmation that this defect has been corrected." Even if the malware author did correct the issue, it's unknown whether those already compromised can benefit, or if they're out of luck. And if an organization paid the ransom and got a faulty decryptor, Halcyon advised immediately shifting from negotiation to "restoring operations through alternate recovery pathways." This means maintaining backups, isolating affected systems, preserving forensic evidence, determining scope, and engaging experienced ransomware incident-response services if needed. About the Author Alexander Culafi Senior News Writer, Dark Reading Alex is an award-winning writer, journalist, and podcast host based in Boston. After cutting his teeth writing for independent gaming publications as a teenager, he graduated from Emerson College in 2016 with a Bachelor of Science in journalism. He has previously been published on VentureFizz, Search Security, Nintendo World Report, and elsewhere. In his spare time, Alex hosts the weekly Nintendo podcast Talk Nintendo Podcast and works on personal writing projects, including two previously self-published science fiction novels. See more from Alexander Culafi