‘Sicarii’ Ransomware Decryption Fails Due to Poor Coding and Potential AI Use

Sicarii Malware’s Strange Behavior Indicates AI Tooling

The newly emerged ‘Sicarii’ ransomware, appearing in late 2025, suffers from a critical flaw: its decryption process is fundamentally broken. Analysis from Halcyon’s Ransomware Research Center reveals that the malware generates a new RSA key pair with each execution, then discards the private key, making decryption impossible even if a ransom is paid.

This failure indicates a lack of technical skill on the part of the developers, potentially stemming from the use of AI-assisted tooling during its creation, a previously uncommon source of ransomware development. The unreliable decryption process highlights the risks of relying on emergent ransomware groups and the increasing complexity of the threat landscape.

Why This Matters

Traditional ransomware models assume a recoverable encryption process tied to a master key, allowing for decryption upon payment. Sicarii deviates from this, resulting in a 100% failure rate for data recovery even with ransom payment. This represents a significant failure scale, costing potential victims both financial loss from the ransom and continued operational disruption due to data inaccessibility.

Key Insights

• Broken Decryption: Sicarii’s discarded private keys prevent successful decryption (Halcyon, 2026).
• Vibe-Coding: The ransomware uses Hebrew and Israeli themes, potentially as a false flag to obfuscate its origins (Check Point Research, 2026).
• AI-Assisted Tooling: Halcyon assesses the poor code quality as a strong indicator of the use of AI in the ransomware’s development (Dark Reading, 2026).

Working Example

(Silently omit entire section as no code exists in context)

Practical Applications

• Use Case: Small businesses are currently the primary targets, with claims of 3-6 compromised victims (Sicarii operators, 2026).
• Pitfall: Paying the ransom is demonstrably ineffective for Sicarii victims, wasting resources and encouraging further attacks.

References:

• https://www.darkreading.com/endpoint-security/vibe-coded-sicarii-ransomware-decrypted
• https://darkreading.com/