Ransomware needs a way in. Stolen credentials are the cheapest one.
Icarus Ransomware Group
Ransomware group profile
9Victims
United KingdomSource country
65Impact score
Description
Icarus is a newly emergent ransomware group first encountered in April 2026, distinguished from the earlier Icarus Stealer malware. The group's operations revolve around financial gain through the exploitation of sensitive data, positioning itself as a data broker engaged in extortion tactics.
Key insights
- •Icarus engages in double extortion and free data leaks to pressure victims into compliance.
- •The group's primary goal is financial profit from the sale or leakage of stolen data.
- •Targets include sensitive data such as personally identifiable information, source code, and KYC documents.
- •Icarus utilizes bespoke malware for ransomware deployment, with detailed attack vectors not yet disclosed.
Threat Level & Status Breakdown
For Icarus · Based on incidents in selected period
1.5threat level
Aggressiveness2.5/ 10
Lethality1/ 10
Criticality1/ 10
Status Breakdown
Data Leaked22.2%2
Claimed77.8%7
First seenJun 2026
Last seenJun 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedSep 5, 2026
Recent activity
Monthly attack count for Icarus in the selected period
9Total attacks
9peak in Jun
9avg / month
Intelligence
IOCs, YARA/Sigma rules, and related families for Icarus
- 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- 46295cac801e5d4857d09837238a6394
- ee497cc061d6a7a59bb66defea65f9a8145ba240
- ce6a63f996df3a1cccb81720e21204b825e0238c
- 40ab50289f7ef5fae60801f88d4541fc
- 5af87dfd673ba2115e2fcf5cfdb727ab
- 24745f213395d77e2caf29cdf5ffd8e20fb835e8842e67462cbefd3be1be8914
- 3e57b3e255ea4eeef742240a3b2d03b8e9fb8f118d889079a164e0ea23345f59
- 4402f6133c97dbb092a611067855b031cc1e3dc178e72053f6ab2b946a24f997
- 47b54312b5cb65ce9f9bab1285f556066fc209f95976e493e414072167406768
- 5234e66392343075b6fe2309b35b0f105658429cea79ce1b34efe74358933b25
- 6224108cc3ca531c5ab214984b64a07566f31fed35b7ea78af79506fe24c70d9
- 8baf22244c810b6d25be595d1f42ec353ff7c8fbd9c37513b47a2ffa8af4e0e3
- 9d5d80254ca4e07a60f8b88b8515c9c580ca83af6e017079d7bf3ab08294522c
- b2bf049bba813039124a63bb29e947e9c847be52658ffca0481ec03dbad455c4
- ea671475338ad6fe402471d7d8d4ef1281f73757aa24a90655f4d914cbe849ac
- f20b7239cf47126100a2bdbce8ee4860941ecbf26c2ba88c5658dc3a91d0caee
- 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- af7ae505a9eed503f8b8e6982036873e
- d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
- 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
- e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
- 87e8230a9ca3f0c5ccfa56f70276e2f2
- eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
- 20d4b8fa017a12a108c87f540836e250
- 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- 3ddf9be5c28fe27dad143a5dc76eea25222ad1dd68934a047064e56ed2fa40c5
- 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
- ee002cb9e51bb8dfa89640a406a1090a
- 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
- 3cedfb74d44f2e84198d23075aef16c34a668ceb
- 4d157073a891d0832b9b05fb8aca73a8
- 551efcdd93ecafc6b54ebb6f8f38c505d42d61ca
- 718812adb0d669eea9606432202371e358c7de6cdeafeddad222c36ae0d3f263
- e4ed441f0f6afb0d8d55af87900ec48f
- ac5bd77fd06ed29bebceb65371387555658870d9
- 09d1e604e8cdd06176fcc3d3698861be20638a4391f9f2d9e23f868c1576ca94
- d414dd4f9db345fa8003e32adc81b362
- 6b0c78f990bb89a5c85456dab55966f178d309dae196077e1c562ce1f59ff72c
- 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
- fd5fdcb0caabedab8adbfb8cae49efeb86d67c19905f86ea40be155ea4cf95c3
- f1d14c0303d45f3f1897edc54641e381dcfcc0f4da8ab5729cb2bd090c7e5d29
- f13c557ec3821f8c574b2ba4209b8f7c7716e5a062b7aa461f7ae6c913f912c0
- e839394551f4820a374b4f3a9110fa67a0e4c916cc3d8f88b096b591b5d54df7
- d1453e7b6e0c205d73d8d87653914ae80d4d581f6c41f1b183f4ef42c70bdaa7
- c3c07ce24fc4ef27633d42f220cb81275f73004c45177c6f501cc9af61d73cb1
- bf797a435f62001800fc624d2446d7347739fe350d0d9c962eeb7146dfc53f32
- 81046e921b34925ef9312c9a62cc5affb0d63e7ca2c13ac486278b291f7c08f2
- 79cffb5ba8c5b0f0c40ce4c229a2369d6a1dafd24659587adab3188bb815199e
- 4acb986c63502258ad11c3ae639658ec4ea2004911728c1782bf63c78359adc2
- 46487fb57b9f2c72859965bcb3f1f5160c21476e26a6eba62f3addc904274188
- 44b49d39e3ba9e1cd02e8ef24332405af46dbbd52f728e68f007dabd305b58c7
- 38bb553058b9684c749a09dfbed2c38bdf5c0e8e302092dadb3aebe69f36e050
- 18b7421abf184e46a64874bebbfd875d
- f5f5b37fd514776f455864502c852773
- bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683
- ac354a4723aaa4f06bec385ddde4a4d0983ad51456f52b31a8068ec97d5b5ea7
- c022afe4cf9e50d49e8ce2b19a158ff0704bcc94b720857b29b6fbe18d7f8475
- 6eb70da269010a7bfadd2a9c35ce31128538661a4c81d3860a9662e32db0081d
- 53b6e5854524cf001c611b3d3474e6dc86a61ae8
- 185105dff99bf9b296366e6b16e9c7321248c190
- 4ec8738fcd63ad2644ae00a7a833aabb
- 4c3b814fc7bcb2cd0b13a88fa7da7101
- 19f88babc16c03cd326666cf8b71557bb3663b954c5f65197257f73dcf738576
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for Icarus
Defense Evasion
T1562
Impair Defenses
T1027
Obfuscated Files or Information
Execution
T1059
Command and Scripting Interpreter
Impact
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
Lateral Movement
T1021
Remote Services
T1021.001
Remote Desktop Protocol
T1080
Taint Shared Content
Other
T1203
T1203
Persistence
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Victims(10)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| H* | France | Claimed | 2 months ago | |
| Genpact | Bermuda | Claimed | 2 months ago | |
| Huntress | United States | Claimed | 3 months ago | |
| HD Supply | United States | Claimed | 3 months ago | |
| GMS | Switzerland | Claimed | 3 months ago | |
| Cqcrm | Namibia | Claimed | 3 months ago | |
| Cbassociations | Namibia | Claimed | 3 months ago | |
| Klue | Canada | Data Leaked | 3 months ago | |
| The Credit Pros | United States | Data Leaked | 3 months ago | |
| Cazh POS | Indonesia | Claimed | 4 months ago |
Affected countries(9)
Countries where this group has been reported to target or leak victims.