Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
rhysida Ransomware Group
Ransomware group profile
75Victims
RussiaSource country
127Impact score
Description
Rhysida is a ransomware group that emerged in 2023, known for its double extortion tactics where it encrypts data and threatens public release unless ransoms are paid. The group employs sophisticated methods to infiltrate networks, primarily targeting critical sectors and leveraging a network of affiliates to maximize its impact.
Key insights
- •Utilizes multi-stage attack strategies including initial exploitation, data exfiltration, and ransomware deployment.
- •Employs double extortion tactics to pressurize victims into paying ransoms quickly.
- •Targets critical sectors such as healthcare and logistics to exploit the urgency of operations during breaches.
- •Utilizes legitimate tools like Cobalt Strike and PowerShell for post-exploitation activities.
- •Demands ransoms primarily in cryptocurrency, typically Bitcoin.
- •Clears forensic evidence by manipulating Windows event logs and deleting shadow copies as a defense evasion tactic.
Threat Level & Status Breakdown
For rhysida · Based on incidents in selected period
4.9threat level
Aggressiveness10/ 10
Lethality0.1/ 10
Criticality4.6/ 10
Status Breakdown
Data Leaked1.3%1
Negotiating1.3%1
Claimed97.3%73
First seenOct 2025
Last seenOct 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedOct 27, 2026
Recent activity
Monthly attack count for rhysida in the selected period
75Total attacks
13peak in Sep
6.3avg / month
↑ 10 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for rhysida
- cb704d2e8df80fd3500a5b817966dc262d80ddb8
- f3a83cffc7187187f8e9d0863074e399
- 61ddf0d5915ecaab536abdcc3cfb5661558bb43f
- fa084ed28c01cab30e9994c71931ddb3424ef6e934dc4b4993d11d827635438c
- b3411927cc7cd05e02ba64b2a789bbde
- 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
- 28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f
- 39539766ae8f5256e6f21d853b8b7ea8f003d29f6d7cd57d1ecb621dc2b97c89
- 8251186b3196e3fefb0dbfcf71dfccc2c1cd66515686c9af8a6fb48766c739c6
- f02622129e7774b7673e2a9f62bb4a208d4a142b5d925532c7920481549bd07b
- 43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2
- 58c852525bf3bea185db34a79c2c5640c02f8291cdbdbe8dd7c0a9d4682f4b2c
- f613966b6ed1f080aacba005b1e48268ef662fffdf9894382299645f42900848
- 7d9f3701bf6f43ab84ce02ce4915dc0703504263db2e1eb65f4f7c791565f731
- fdd4e0bb2a4475e4e44154d7bf29490de98496553af3c8807f999ab8b920263f
- f6c7ecff7b07cba12bd79833a23d12d5fcd12a75a3394d923b994ba0ed535db3
- dee5915b76dd3bae3d3cedc0c1d1b055daab5852cba4868c92eb88b9a84a0b00
- 10d8e4ca3fa2902859c77f41baee4dda
- 26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b
- b26cfde4ca74d5d5377889bba5b60b5fc72dda75
- d1cd8c4574c3290ae16bf4e718c5e89dadef5b2fd4eea2211a19a6180ff8ee5b
- e86bb8361c436be94b0901e5b39db9b6666134f23cce1e5581421c2981405cb1
- 074d26b9b128be8e4a77d73dcac31307f28b0e8b8097622c02267be349fe4b4f
- 5627457a12c562b7a08f634878758d268b9fde44ce35292e887ca13741c5f942
- 62971070d6a8b9fca8a50b9cd8e91545bfcc2c2b6665f134c112081f54e6bf31
- 045c041354a6d6b47e91e1124a7dc77397c18e0695ccbc73f87b12a0a1079d46
- 37ff328175acd45ef27d3d339c3127a7612ad713fccd9c9aae01656dfbf13056
- 25a1d86248b7cf5f870dbc9960ce336266473bd40be3a8dcb35e6be88c9df261
- 9ff906ffcde32e4c6fb3ea4652e6d6326713a7fde8bb783b52f12a1f382f8798
- b9d0838be8952ebd4218c8f548ce94901f789ec1e32f5eaf46733f0c94c77999
- be2b45b7df8e7dea6fb6e72d776f41c50686c2c9cfbaf4d456bcc268f10ab083
- 8b9c7d2554fe315199fae656448dc193accbec162d4afff3f204ce2346507a8a
- 933acdb61d5d05bb55cd56957312b677719ac237a2daae0f1daf9d70dc68f2de
- 2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9
- 6a58b52b184715583cda792b56a0a1ed
- d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40
- 34ca75a8c190f20b8a7596afeb255f2228cb2467bd210b2637965b61ac7ea907
- eaca86a3f397d10d9188be9fcd2af1a7a30a9b573b2282b0b8300efeb5ff1efd
- 282df7bcb720a5b6f409caf9ccda2f75
- 0e62d10ff194e84ed8c6bd71620f56ef9e557072
- 3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05
- a4f8ba563c8478a674fc8dff0a8d179adfb39f7dca143e73d139c814664fc419
- f2a3b52572a8a5da9cac1bf02427929acc101e5b9a2ae69093aad1c4f51d08c6
- c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f
- 9375cff0413111d3b88a00104b2a6676
- e11d147dad6e47a1cecb1f2755f95a55
- 6bffc6c7caa2eb2fa90fac0317f63338
- bd5354cd813130687c66ecc132d50770d48417cf
- 92c65b58c4925534c2ce78e54b0e11ecaf45ed8cf0344ebff46cdfc4f2fe0d84
- 4a692e244a389af0339de8c2d429b541d6d763afb0a2b1bb20bee879330f2f42
- b902954d634307260d5bd8fb6248271f933c1cbc649aa2073bf05e79c1aedb66
- 20c730c7033b5bdc0a6510825e90449ba8f87942d2d7f61fa1ba5f100e98c141
- 36d6655962cfded3a8a170b6f09dac5f7a39e65fdd3007c5532ae744da4f6aab
- 09793a85d372f044fe53c4b47c47049c6bc13d1141334727800b2e32e6d92342
- 29efd64dd3c7fe1e2b022b7ad73a1ba5
- e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
- a26f0a2da63a838161a7d335aaa5e4b314a232acc15dcabdb6f6dbec63cda642
- 54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b
- 5537c708edb9a2c21f88e34e8a0f1744
- 86233a285363c2a6863bf642deab7e20f062b8eb
- 4fdabe571b66ceec3448939bfb3ffcd1
- 763499b37aacd317e7d2f512872f9ed719aacae1
- 0c8e88877383ccd23a755f429006b437
- 576d07cc8919c68914bf08663e0afd00d9f9fbf5263b5cccbded5d373905a296
- f3abb0cc802f3d7b95fc8762b94bdcb13bf39634c40c357301c4aa1d67a256fb
- 80104e0ad490b44a632a15e5875e7626db7f35fa94d7aadf19c45a621d75c7e0
- 132870a1ae6a0bdecaa52c03cfe97a47df8786f148fa8ca113ac2a8d59e3624a
- dd95377842932d77e225b126749e1e6e8ecd6f5c6540d084a551a80a54d02d7d
- 21ab4357262993a042c28c1cdb52b2dab7195a6c30fa8be723631604dd330b29
- b46949feeda8726c0fb86d3cd32d3f3f53f6d2e6e3fcd6f893a76b8b2632b249
- b766522dd4189fef7775d663e5649ba9d8be8e03022039d20848fcbc3643e5f2
- d3606e2e36db0a0cb1b8168423188ee66332cae24fe59d63f93f5f53ab7c3029
- 857e2f63a1078d49adc59a03482f7b362563f16fb251f174bdaa7759ed47922a
- e391c2d3e8e4860e061f69b894cf2b1ba578a3e91de610410e7e9fa87c07304c
- c0976a1fbc3dd938f1d2996a888d0b3a516b432a2c38d788831553d81e2f5858
- 4afd9f0dde092daeac3f3e6ffb0aee06682b3dba6005d2bd1a914eefd5cc6a30
- a6020794bd6749e0765966cd65ca6d5511581f47cc2b38e41cb1e7fddaa0b221
- 722fff8f38197d1449df500ae31a95bb34a6ddaba56834b13eaaff2b0f9f1c8b
- 597de376b1f80c06d501415dd973dcec
- 4d97497247e65144814d99eb0dab77d39f4863058dd1109637d5be39be082c57
- 703a8460e1a86145c1d13ad75c6c31d101e1618cb7c56a2b0e14a56f0c585287
- 867a91a0d1d0a8c6fe8431bd1c3764c3
- b0cfa2089802634ffb8c77962cdb18317a6332d4
- 64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983
- edbf152ed9ac79e5d9e0111d1071af48
- 1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069
- 3928c5874249cc71b2d88e5c0c00989ac394238747bb7638897fc210531b4aab
- b88f173337ab103181feb33681f0b297
- 6287004d7d40d23809273abde38101a580906db8
- b365af317ae730a67c936f21432b9c71
- a0bdfac3ce1880b32ff9b696458327ce352e3b1d
- e97bdf7fafb1cb2a2bf0a4e14f51e18a34f3ff2f6f7b99731e93070d50801bef
- 1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c
- 6c6e7eda17d7296d5c0c0cda8db200d0248c14f8682cbd7d3ffff110916e3cf2
- 77ec63bda74bd0d0e0426dc8f8008506
- 46f227d962a503eb6276f99d63b891e8de60a1eaf02c768ac4b0aba2e3ac5d56
- a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6
- 17fb52476016677db5a93505c4a1c356984bc1f6a4456870f920ac90a7846180
- 10955a02ef3fd3f80f20062c401bf7960ff6ce94
- e736229e890a138ccf7810e00a6bb50d
- 188d0220bc3adeb53e70ea6fd57ac87aaad367af86323b7f7ac030af555077dc
- b8cc6a24915ae61642ad9d0200291c50c47e2d0a6c4549072a14c019bb5260fc
- ed3cc2c262d38c32bf6a789b5af0f5652497927b
- 8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef
- 0edffd2d6933146b600d1578f4654be6
- 97d61059ae372ee9f9bcba115c8269bba3cdad73
- 8c57b97b04d7eabbae651c3400a5e6b897aea1ae8964507389340c44b99c523a
- 5410539e34fb934133d6c689072ba49d
- e36469145749addf8d9b235ddd655bdb62d67b83
- fb9ab37dfed2c2c8db82cc0c25e4fa7c
- 09bd833782a6b2cccdd3285ad12f23bedb1dbb77
- e8d3aeea7617982bb6e484a9f8307e6b
- 24e3af0612ac12377220f86623a8094bf136c646
- 94b0cfa3c654f17562a62541238ff6bb
- 94aa7417f388c61a2d63ddcba6efec80c55f8555
- e2919dea773eb0796e46e126dbce17b1
- 69d58a5ff2c0343119816d34ce9da8d9bc6f47c9
- 3e993dfe5ce90dadb0cf0707d260febd
- 603712012545314a2f3d2f6f21e00d206a24f1fb
- f97bf76439175ff3f09758bfe0a1a1f4
- 1d20ea757b8d5954418363bed5153144c1e19440
- a395e3053eabada168f6e82134078185
- 69c0e6ad69fc1def6107d3ee83c1f5161df03b5e
- c341d93161a6db36d22215fa594d0b3c
- 5e1f8e2c9421b3f7caba07ae6be503d272ebb8eb
- 128409d5cb9701cd12600baf7a623794
- aa7980d0c957891cc6620d70da2ea60a04794439cd6c7fd1ac9dd68ba8b1b7c8
- 1374cb6a9bdcc5ac4e9d2bcf60aeea14336f32f45b33b60e90baca2a22edc6ee
- 10370f821ef2d769bcb287b3f5ab081c4949a97891a25a23688e8c553bd393df
- 30a2dff640f1029fd1d17f76c49a47312090723cdfbadbe157ddf69357677506
- 33338f9323f7250f8014b7bbc80005e7fbad1a8c8061104efa4568398ac16939
- 4c2a6007bd3dd10925d2bb7a26d5cffc6b273a07d19cbfca2caeeb0ad07b87f7
- 4efa5bd742311ac26e6ed72796bc818562052fa4a82e3aba90fda6d6da344957
- 5530b97407703b9459a5dd3e8a753d6dbbc1bba8e651f3c74aa4731ad16d2779
- 5cc3f4c204bb1fb55c05b8b926cf89a281e813dbb3a5128ece7328f9ba4d940c
- 657858f6bfadc7b53896f773c0b4934aa50d8f06ffff44fb8dc71bf215aa4e99
- 6b8e2998545dea426dbae0583d4d5f77312df43031ffca354a169ecdc758cb62
- 7c54bb55a5769e93b078ae5dc0ce1647796e70518e782599ba12e4edcbf85d0f
- 90846788fa96dfa090cad5340f7f138c37bdb3e987d75c5091f700deb0b0b6ba
- 9f3a663da20d47d8daf521ad68c3f4bb3c1db894cb0ea789aebd1775d305baff
- a3e638c6eb808330a914f0b8e1f1aca467bd12d08b38ebb2a959fba1ae174756
- b58a509bdc350148990318ed765604aaca2c66a5da8969aafe0924bccdffc964
- b645cedc3bcbbcd40a4155b166f88dc4d6a2639d8cf09a46fc889a462c116b3b
- b66738fa361e60d92aab7a704cc56ace35096d2f181c37b20089658fd1217e97
- df00f880199b6e344d54d0140a81c02f2a5c867578aff9ab3ed0d4c284d61e87
- df4a5b9469c456f6c3dd06492a2e14772965497c4d3cfe0148d28c0b8a3c17ec
- f3a939131ffaf473f8b1ffa0cd11d8cbce46f50dcc7e9fd2ff8404201ab5bc8e
- 63c4c31965ed08a3207d44e885ebd5e4
- cafa8038ea7e46860c805da5c8c1aa38da070fa7d540f4b41d5e7391aa9a8079
- 12bf5f988ff62c112fac061d9ec97c47
- 77f82a88068d77ba9ece00d21bf3a4db
- cedf93d2a9dae5a41c7797baaf535f008d0166e9
- 33dd66da63f57e1d64d469172a5d5e7615924bcde919e962c4a5a00c51306051
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- 51fd557a7325dd58cfcabebbbc33ef452d93f812c189360d4f2bf87c6df0a59c
- 67e8e85e6e316cd3008a7d8ce0d72064416c7a00
- 3eabb1c39d494cbc17259f36f56bf5d6
- b76c65ca6c6e75aaa22e69e382088c0c9b8486ef2d7496165e2c737a2b108bb5
- 5ae94ec248a3df8ef31e4d7e1eace31448497fe1258649d34a8c4207eddc2876
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for rhysida
CVE-2025-5777
CVE-2022-3236
CVE-2022-30190
CVE-2022-26134
CVE-2020-1472
CVE-2018-0798
Collection
T1005
Data from Local System
T1119
Automated Collection
Defense Evasion
T1027
Obfuscated Files or Information
T1036
Masquerading
T1055.003_1
Thread Execution Hijacking
T1055_1
Process Injection
T1497
Virtualization/Sandbox Evasion
T1564
Hide Artifacts
T1564.004
NTFS File Attributes
T1620
Reflective Code Loading
Discovery
T1010
Application Window Discovery
T1057
Process Discovery
T1082
System Information Discovery
T1083
File and Directory Discovery
T1497_2
Virtualization/Sandbox Evasion
T1518.001
Security Software Discovery
Execution
T1059
Command and Scripting Interpreter
T1129
Shared Modules
Impact
T1486
Data Encrypted for Impact
Persistence
T1547.001
Registry Run Keys / Startup Folder
Privilege Escalation
T1055
Process Injection
T1055.003
Thread Execution Hijacking
T1547.001_1
Registry Run Keys / Startup Folder
Victims(75)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Machelen (Belgium) | Belgium | Claimed | about 11 hours ago | |
| MISC Group | Malaysia | Claimed | 1 day ago | |
| Sanders Law Group | United States | Negotiating | 5 days ago | |
| Line2Line Coatings | United States | Claimed | 5 days ago | |
| DR.SCHNELL GmbH & Co. KGaA | Germany | Claimed | 6 days ago | |
| Reed & Giordano PA | United States | Claimed | 17 days ago | |
| Charles E. Tabor AAL LLC | United States | Claimed | 17 days ago | |
| Gress Clark Young & Schoepper | United States | Claimed | 18 days ago | |
| Anne Arundel County | United States | Claimed | 19 days ago | |
| RealManage | United States | Claimed | 19 days ago | |
| Skaff Group | Lebanon | Claimed | 25 days ago | |
| Mat Bao Corporation | Vietnam | Claimed | 26 days ago | |
| Electro Heat Sweden AB | Sweden | Claimed | 26 days ago | |
| clicks digital GmbH | Germany | Claimed | 28 days ago | |
| Law Offices of R. David Williams, P.A. | United States | Claimed | 28 days ago | |
| NEAD SRL | Italy | Claimed | about 1 month ago | |
| NEAD Pro | Italy | Claimed | about 1 month ago | |
| Legis | Colombia | Claimed | about 1 month ago | |
| Kreishandwerkerschaft Borken | Germany | Claimed | about 1 month ago | |
| MPA Pharma GmbH | Germany | Claimed | about 1 month ago |
United StatesProfessional Servicesgressandclarklaw.com
Claimed
18 days agoUnited StatesProfessional Servicesdwilliamslaw.com
Claimed
28 days agoPage 1 of 4
Affected countries(57)
Countries where this group has been reported to target or leak victims.
🇦🇪United Arab Emirates🇦🇷Argentina🇦🇹Austria🇦🇺Australia🇧🇪Belgium🇧🇬Bulgaria🇧🇷Brazil🇨🇦Canada🇨🇭Switzerland🇨🇱Chile🇨🇳China🇨🇴Colombia🇩🇪Germany🇩🇰Denmark🇩🇴Dominican Republic🇪🇬Egypt🇪🇸Spain🇫🇷France🇬🇧United Kingdom🇭🇺Hungary🇮🇩Indonesia🇮🇪Ireland🇮🇱Israel🇮🇳IndiaIran, Islamic Republic of🇮🇹Italy🇯🇴Jordan🇯🇵Japan🇰🇪Kenya🇰🇼Kuwait🇱🇧Lebanon🇱🇹Lithuania🇱🇻LatviaMartinique🇲🇽Mexico🇲🇾Malaysia🇳🇪Niger🇳🇬Nigeria🇳🇱Netherlands🇳🇴Norway🇳🇿New Zealand🇵🇪Peru🇵🇭Philippines🇵🇱Poland🇵🇹Portugal🇶🇦QatarRussian Federation🇸🇪Sweden🇸🇬Singapore🇸🇮Slovenia🇸🇻El Salvador🇹🇭ThailandTaiwan, Province of China🇺🇸United States🇻🇳Vietnam🇿🇦South AfricaGlobal