VIBE-CODED 'SICARII' RANSOMWARE CAN'T BE DECRYPTED

Summary from the TLDR InfoSec newsletter

The Sicarii ransomware, which emerged as a RaaS offering in December, contains a critical design flaw that makes decryption impossible even if victims pay, as the malware regenerates new RSA key pairs locally during each execution and discards the private key needed for recovery. The ransomware's suspicious "Israeli/Jewish" branding with Hebrew language and historical symbols appears to be a false flag, given its primarily Russian-language operations and machine-translated Hebrew content with errors. It was likely that inexperienced developers used AI-assisted tooling to create the poorly coded ransomware. Organizations affected are advised to abandon ransom negotiations and focus on alternate recovery pathways, including backups and incident response services.