Ransomware needs a way in. Stolen credentials are the cheapest one.
rhysida Ransomware Group
Ransomware group profile
67Victims
RussiaSource country
124Impact score
Description
Rhysida is a ransomware group that emerged in 2023, known for its double extortion tactics where it encrypts data and threatens public release unless ransoms are paid. The group employs sophisticated methods to infiltrate networks, primarily targeting critical sectors and leveraging a network of affiliates to maximize its impact.
Key insights
- •Utilizes multi-stage attack strategies including initial exploitation, data exfiltration, and ransomware deployment.
- •Employs double extortion tactics to pressurize victims into paying ransoms quickly.
- •Targets critical sectors such as healthcare and logistics to exploit the urgency of operations during breaches.
- •Utilizes legitimate tools like Cobalt Strike and PowerShell for post-exploitation activities.
- •Demands ransoms primarily in cryptocurrency, typically Bitcoin.
- •Clears forensic evidence by manipulating Windows event logs and deleting shadow copies as a defense evasion tactic.
Threat Level & Status Breakdown
For rhysida · Based on incidents in selected period
3.6threat level
Aggressiveness6/ 10
Lethality0.1/ 10
Criticality5.1/ 10
Status Breakdown
Data Leaked1.5%1
Claimed98.5%66
First seenSep 2025
Last seenSep 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedSep 17, 2026
Recent activity
Monthly attack count for rhysida in the selected period
67Total attacks
13peak in Oct
5.6avg / month
↑ 4 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for rhysida
- cb704d2e8df80fd3500a5b817966dc262d80ddb8
- f3a83cffc7187187f8e9d0863074e399
- 61ddf0d5915ecaab536abdcc3cfb5661558bb43f
- fa084ed28c01cab30e9994c71931ddb3424ef6e934dc4b4993d11d827635438c
- 746710470586076bb0757e0b3875de9c90202be2
- b3411927cc7cd05e02ba64b2a789bbde
- 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
- 28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f
- 43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2
- 58c852525bf3bea185db34a79c2c5640c02f8291cdbdbe8dd7c0a9d4682f4b2c
- fe84a4a119917f15418659ed30699d873b6445aa053d9303287b085e35bf1002
- 10d8e4ca3fa2902859c77f41baee4dda
- 26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b
- b26cfde4ca74d5d5377889bba5b60b5fc72dda75
- e86bb8361c436be94b0901e5b39db9b6666134f23cce1e5581421c2981405cb1
- 37ff328175acd45ef27d3d339c3127a7612ad713fccd9c9aae01656dfbf13056
- 30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446
- 36e3fcd6a4c7c9db985be77ea6394b2ed019332fdae4739df2f96a541ea52617
- 5d7aa3474e734913ecb4b820c0c546c92f7684081c519eecd3990e11a19bf2ba
- 9f34d28562e7e1e3721bbf679c58aa8f5898995ed999a641f26de120f3a42cf4
- 9ff906ffcde32e4c6fb3ea4652e6d6326713a7fde8bb783b52f12a1f382f8798
- b82bde3fe5ee900a76ac27b4869ed9aa0802c63bbd72b3bfb0f1abce6340cc6c
- b9d0838be8952ebd4218c8f548ce94901f789ec1e32f5eaf46733f0c94c77999
- be2b45b7df8e7dea6fb6e72d776f41c50686c2c9cfbaf4d456bcc268f10ab083
- 8b9c7d2554fe315199fae656448dc193accbec162d4afff3f204ce2346507a8a
- 933acdb61d5d05bb55cd56957312b677719ac237a2daae0f1daf9d70dc68f2de
- 2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9
- 91270525521b7fe0d986db19747f47d34b6318ad
- dca83f08d448911a14c22ebcacc5ad57
- 3902165d0645afdb4b7d95f5cc55d65ecee17d3b77a31d51170e0beae3fd296a
- 6a58b52b184715583cda792b56a0a1ed
- 569d2b5701755260514fe1563d7530bb
- 025c1c35c3198e6e3497d5dbf97ae81f
- 34ca75a8c190f20b8a7596afeb255f2228cb2467bd210b2637965b61ac7ea907
- f6e5f0ed974c89e2b4a47989fc987c79
- 282df7bcb720a5b6f409caf9ccda2f75
- 0e62d10ff194e84ed8c6bd71620f56ef9e557072
- 3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05
- a4f8ba563c8478a674fc8dff0a8d179adfb39f7dca143e73d139c814664fc419
- f2a3b52572a8a5da9cac1bf02427929acc101e5b9a2ae69093aad1c4f51d08c6
- 634a9af8d3f2fa0d38820d577fb0fbeb
- c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f
- 26f41a46d0addde100bb9512a130de5e
- 9375cff0413111d3b88a00104b2a6676
- e11d147dad6e47a1cecb1f2755f95a55
- 6bffc6c7caa2eb2fa90fac0317f63338
- bd5354cd813130687c66ecc132d50770d48417cf
- 92c65b58c4925534c2ce78e54b0e11ecaf45ed8cf0344ebff46cdfc4f2fe0d84
- b902954d634307260d5bd8fb6248271f933c1cbc649aa2073bf05e79c1aedb66
- 250e81eeb4df4649ccb13e271ae3f80d44995b2f8ffca7a2c5e1c738546c2ab1
- 59a9ca795b59161f767b94fc2dece71a
- 20c730c7033b5bdc0a6510825e90449ba8f87942d2d7f61fa1ba5f100e98c141
- 36d6655962cfded3a8a170b6f09dac5f7a39e65fdd3007c5532ae744da4f6aab
- 29efd64dd3c7fe1e2b022b7ad73a1ba5
- e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
- a26f0a2da63a838161a7d335aaa5e4b314a232acc15dcabdb6f6dbec63cda642
- 54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b
- 5537c708edb9a2c21f88e34e8a0f1744
- 86233a285363c2a6863bf642deab7e20f062b8eb
- 4fdabe571b66ceec3448939bfb3ffcd1
- 763499b37aacd317e7d2f512872f9ed719aacae1
- 0c8e88877383ccd23a755f429006b437
- f3abb0cc802f3d7b95fc8762b94bdcb13bf39634c40c357301c4aa1d67a256fb
- 80104e0ad490b44a632a15e5875e7626db7f35fa94d7aadf19c45a621d75c7e0
- 132870a1ae6a0bdecaa52c03cfe97a47df8786f148fa8ca113ac2a8d59e3624a
- dd95377842932d77e225b126749e1e6e8ecd6f5c6540d084a551a80a54d02d7d
- 21ab4357262993a042c28c1cdb52b2dab7195a6c30fa8be723631604dd330b29
- a2754d7995426b58317e437f8ed6770cd7bb7b18d971e23b2b300b75e34fa086
- b46949feeda8726c0fb86d3cd32d3f3f53f6d2e6e3fcd6f893a76b8b2632b249
- b766522dd4189fef7775d663e5649ba9d8be8e03022039d20848fcbc3643e5f2
- d3606e2e36db0a0cb1b8168423188ee66332cae24fe59d63f93f5f53ab7c3029
- 857e2f63a1078d49adc59a03482f7b362563f16fb251f174bdaa7759ed47922a
- 4f1b8c9209fa2684aa3777353222ad1c7716910dbb615d96ffc7882eb81dd248
- e391c2d3e8e4860e061f69b894cf2b1ba578a3e91de610410e7e9fa87c07304c
- c0976a1fbc3dd938f1d2996a888d0b3a516b432a2c38d788831553d81e2f5858
- 4afd9f0dde092daeac3f3e6ffb0aee06682b3dba6005d2bd1a914eefd5cc6a30
- a6020794bd6749e0765966cd65ca6d5511581f47cc2b38e41cb1e7fddaa0b221
- 722fff8f38197d1449df500ae31a95bb34a6ddaba56834b13eaaff2b0f9f1c8b
- 597de376b1f80c06d501415dd973dcec
- 4d97497247e65144814d99eb0dab77d39f4863058dd1109637d5be39be082c57
- 703a8460e1a86145c1d13ad75c6c31d101e1618cb7c56a2b0e14a56f0c585287
- 867a91a0d1d0a8c6fe8431bd1c3764c3
- bab3c87cac6db1700f0a0babaa31f5cd544961d1b9ec03fd8bcdeff837fc9755
- 54416fc42afa9b09ea7e8d8e318f4891
- 93be893ff74816c49f2706f222789027
- d86383882515b7a9218d5f69924feadf
- ae6eb3cce06f666934e03dd46269526e56aff3b1
- 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f
- 2b825ea77e240d2ab6b6695a602cb07c
- 7cfba113342f78b5909f606c26fc1dc4
- ddaa09b5c3bf5aa24e300c24905469f2
- 6dd8c26f64df37d0c7645b63c9bba51f
- b0cfa2089802634ffb8c77962cdb18317a6332d4
- 64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983
- edbf152ed9ac79e5d9e0111d1071af48
- 44c7d18633b5741db270a6bd378b6f3c
- 338d4f4ec714359d589918cee1adad12ef231907
- d5c2f87033a5baeeb1b5b681f2c4a156ff1c05ccd1bfdaf6eae019fc4d5320ee
- 1e256229b58061860be8dbf0dc4fe67e
- d345e1d251714508a28544dc00e5950b05116ce1
- 1845a910dcde8c6e45ad2e0c48439e5ab8bbbeb731f2af11a1b7bbab3bfe0127
- 7cbf2951f13cd54abd951b1d289e2655
- edfae1a69522f87b12c6dac3225d930e4848832e3c551ee1e7d31736bf4525ef
- 1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069
- 7a96d9f7a25a67ec2873bb814cb0ba104d3b7c1651f65ff09d8e1f76cba6fb79
- 3928c5874249cc71b2d88e5c0c00989ac394238747bb7638897fc210531b4aab
- b88f173337ab103181feb33681f0b297
- 6287004d7d40d23809273abde38101a580906db8
- fae1061813f2148296767d28262d2c25
- c7d994eb2042633172bd8866c9f163be531444ce3126d5f340edd25cbdb473d4
- b365af317ae730a67c936f21432b9c71
- a0bdfac3ce1880b32ff9b696458327ce352e3b1d
- e936445935c4a636614f7113e4121695a5f3e4a6c137b7cdcceb6f629aa957c4
- 52c6326af893e3baa1c43c59827f61eb
- e97bdf7fafb1cb2a2bf0a4e14f51e18a34f3ff2f6f7b99731e93070d50801bef
- 1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c
- ffa28db79daca3b93a283ce2a6ff24791956a768cb5fc791c075b638416b51f4
- 2833c82055bf2d29c65cd9cf6684449a
- a53a9ca8a074c7108f8412c3f8c1fc5d
- 6c6e7eda17d7296d5c0c0cda8db200d0248c14f8682cbd7d3ffff110916e3cf2
- 77ec63bda74bd0d0e0426dc8f8008506
- 46f227d962a503eb6276f99d63b891e8de60a1eaf02c768ac4b0aba2e3ac5d56
- a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6
- e0ae6b6cfd6544a02517e91b74bda9d5cb98674dc04609743de012354c2cdf22
- 17fb52476016677db5a93505c4a1c356984bc1f6a4456870f920ac90a7846180
- 10955a02ef3fd3f80f20062c401bf7960ff6ce94
- e736229e890a138ccf7810e00a6bb50d
- 188d0220bc3adeb53e70ea6fd57ac87aaad367af86323b7f7ac030af555077dc
- 24a648a48741b1ac809e47b9543c6f12
- 3e2272b916da4be3c120d17490423230ab62c174
- 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
- 96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
- b8cc6a24915ae61642ad9d0200291c50c47e2d0a6c4549072a14c019bb5260fc
- ed3cc2c262d38c32bf6a789b5af0f5652497927b
- 12b3f4590fddb45866f2db8364337fd045d502d25677e084b9f9c302c418c411
- 39a1e3da4a981c5bc73f87d4a04d3b466f301c0321ce10c22fcc915bb6f69007
- 8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef
- 0edffd2d6933146b600d1578f4654be6
- 97d61059ae372ee9f9bcba115c8269bba3cdad73
- 8c57b97b04d7eabbae651c3400a5e6b897aea1ae8964507389340c44b99c523a
- 5410539e34fb934133d6c689072ba49d
- db89ec570e6281934a5c5fcf7f4c8967
- 0098c79e1404b4399bf0e686d88dbf052269a302
- e36469145749addf8d9b235ddd655bdb62d67b83
- fb9ab37dfed2c2c8db82cc0c25e4fa7c
- 09bd833782a6b2cccdd3285ad12f23bedb1dbb77
- e8d3aeea7617982bb6e484a9f8307e6b
- 24e3af0612ac12377220f86623a8094bf136c646
- 94b0cfa3c654f17562a62541238ff6bb
- 94aa7417f388c61a2d63ddcba6efec80c55f8555
- e2919dea773eb0796e46e126dbce17b1
- 5195ff04b50d41c3c5d2c4c441ea021e9822860f
- b67c8752622d53be9f966d66e960745d
- 69d58a5ff2c0343119816d34ce9da8d9bc6f47c9
- 3e993dfe5ce90dadb0cf0707d260febd
- 603712012545314a2f3d2f6f21e00d206a24f1fb
- f97bf76439175ff3f09758bfe0a1a1f4
- 1d20ea757b8d5954418363bed5153144c1e19440
- a395e3053eabada168f6e82134078185
- 69c0e6ad69fc1def6107d3ee83c1f5161df03b5e
- c341d93161a6db36d22215fa594d0b3c
- 5e1f8e2c9421b3f7caba07ae6be503d272ebb8eb
- 128409d5cb9701cd12600baf7a623794
- aa7980d0c957891cc6620d70da2ea60a04794439cd6c7fd1ac9dd68ba8b1b7c8
- 1374cb6a9bdcc5ac4e9d2bcf60aeea14336f32f45b33b60e90baca2a22edc6ee
- 10370f821ef2d769bcb287b3f5ab081c4949a97891a25a23688e8c553bd393df
- 30a2dff640f1029fd1d17f76c49a47312090723cdfbadbe157ddf69357677506
- 33338f9323f7250f8014b7bbc80005e7fbad1a8c8061104efa4568398ac16939
- 4c2a6007bd3dd10925d2bb7a26d5cffc6b273a07d19cbfca2caeeb0ad07b87f7
- 4efa5bd742311ac26e6ed72796bc818562052fa4a82e3aba90fda6d6da344957
- 5530b97407703b9459a5dd3e8a753d6dbbc1bba8e651f3c74aa4731ad16d2779
- 5cc3f4c204bb1fb55c05b8b926cf89a281e813dbb3a5128ece7328f9ba4d940c
- 657858f6bfadc7b53896f773c0b4934aa50d8f06ffff44fb8dc71bf215aa4e99
- 6b8e2998545dea426dbae0583d4d5f77312df43031ffca354a169ecdc758cb62
- 7c54bb55a5769e93b078ae5dc0ce1647796e70518e782599ba12e4edcbf85d0f
- 90846788fa96dfa090cad5340f7f138c37bdb3e987d75c5091f700deb0b0b6ba
- 9f3a663da20d47d8daf521ad68c3f4bb3c1db894cb0ea789aebd1775d305baff
- a3e638c6eb808330a914f0b8e1f1aca467bd12d08b38ebb2a959fba1ae174756
- b58a509bdc350148990318ed765604aaca2c66a5da8969aafe0924bccdffc964
- b645cedc3bcbbcd40a4155b166f88dc4d6a2639d8cf09a46fc889a462c116b3b
- b66738fa361e60d92aab7a704cc56ace35096d2f181c37b20089658fd1217e97
- df00f880199b6e344d54d0140a81c02f2a5c867578aff9ab3ed0d4c284d61e87
- df4a5b9469c456f6c3dd06492a2e14772965497c4d3cfe0148d28c0b8a3c17ec
- f3a939131ffaf473f8b1ffa0cd11d8cbce46f50dcc7e9fd2ff8404201ab5bc8e
- 63c4c31965ed08a3207d44e885ebd5e4
- cafa8038ea7e46860c805da5c8c1aa38da070fa7d540f4b41d5e7391aa9a8079
- 12bf5f988ff62c112fac061d9ec97c47
- 6d390038003c298c7ab8f2cbe35a50b07e096554
- 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
- c3804d1329b55a37bfa2f835e1e9bbc7bdb2b260f8e3627c06e02c9f52685d44
- 728eca0c2c3030179d8546a15ac62c2e
- 2b7e40cf217e53de3d5b3022f99b773afc02c880
- 10ea5ac09ec72101c6f8656f3f08f6f9495f8b43849f27928efd6485cee04913
- 77f82a88068d77ba9ece00d21bf3a4db
- cedf93d2a9dae5a41c7797baaf535f008d0166e9
- 33dd66da63f57e1d64d469172a5d5e7615924bcde919e962c4a5a00c51306051
- f339e7da7d05f6057fdfcdd3742bfcf365fee2a9
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- 51fd557a7325dd58cfcabebbbc33ef452d93f812c189360d4f2bf87c6df0a59c
- 67e8e85e6e316cd3008a7d8ce0d72064416c7a00
- 3eabb1c39d494cbc17259f36f56bf5d6
- b76c65ca6c6e75aaa22e69e382088c0c9b8486ef2d7496165e2c737a2b108bb5
- 5ae94ec248a3df8ef31e4d7e1eace31448497fe1258649d34a8c4207eddc2876
- 61ca00df551f138d3f8602c19936c4a70b1da581183b8d1264fbd2bc416361cf
- 2bf93d6d9c2f2a8e945e6f78e16a66485c2f66469269a934f0d28657ea933805
- 026d1668fabced79573257f6741dc8ef29542cc0
- 9b5b0e7e88bc132d5bc1dd4c4f41e7be
- 0007e093f1e85701653bfa5ce5e792f0797d49631881b44627fbd9a4b68184e4
- 001116d6822817a15272863143ba06c9a99220d405c9a5ee8005fbe73e09507d
- 001afb53c471cd90de621df8c83fb192247616bd6d10285dacdcb47839401203
- 2b06cdf30ade079c57f6e8ec16fa27563855265463bede417a2dd63a631b6a21
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for rhysida
CVE-2025-5777
CVE-2022-3236
CVE-2022-30190
CVE-2022-26134
CVE-2020-1472
CVE-2018-0798
Collection
T1005
Data from Local System
T1119
Automated Collection
Defense Evasion
T1027
Obfuscated Files or Information
T1036
Masquerading
T1055.003_1
Thread Execution Hijacking
T1055_1
Process Injection
T1497
Virtualization/Sandbox Evasion
T1564
Hide Artifacts
T1564.004
NTFS File Attributes
T1620
Reflective Code Loading
Discovery
T1010
Application Window Discovery
T1057
Process Discovery
T1082
System Information Discovery
T1083
File and Directory Discovery
T1497_2
Virtualization/Sandbox Evasion
T1518.001
Security Software Discovery
Execution
T1059
Command and Scripting Interpreter
T1129
Shared Modules
Impact
T1486
Data Encrypted for Impact
Persistence
T1547.001
Registry Run Keys / Startup Folder
Privilege Escalation
T1055
Process Injection
T1055.003
Thread Execution Hijacking
T1547.001_1
Registry Run Keys / Startup Folder
Victims(67)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Axdia International | Germany | Claimed | 6 days ago | |
| General Santos Doctors Hospital | Philippines | Claimed | 8 days ago | |
| Professional Retail Services | United States | Claimed | 8 days ago | |
| SAD'S Interim | France | Claimed | 10 days ago | |
| Rug & Home | United States | Claimed | 11 days ago | |
| Szechenyi Programiroda Nonprofit Kf | Hungary | Claimed | 17 days ago | |
| Valley Health Team | United States | Claimed | 21 days ago | |
| Berlin, Germany | Germany | Data Leaked | 21 days ago | |
| CRI Electric, Inc | United States | Claimed | 27 days ago | |
| Coming soon | — | Claimed | 28 days ago | |
| Fairview Dental Group | United States | Claimed | 28 days ago | |
| Battle Creek Public Schools | United States | Claimed | 28 days ago | |
| Pierce Township | United States | Claimed | about 1 month ago | |
| SIA Medical Centre | Latvia | Claimed | about 1 month ago | |
| Lawson Roofing | United States | Claimed | 3 months ago | |
| IDS Group | United Kingdom | Claimed | 4 months ago | |
| Landeshauptstadt Stuttgart | Germany | Claimed | 4 months ago | |
| Tower View Primary School | United Kingdom | Claimed | 4 months ago | |
| Stelia North America | Canada | Claimed | 5 months ago | |
| Southold Town Senior ServicesSouthold Police Department | United States | Claimed | 7 months ago |
United StatesGovernment & Defense
Claimed
7 months agoPage 1 of 4
Affected countries(54)
Countries where this group has been reported to target or leak victims.
🇦🇪United Arab Emirates🇦🇷Argentina🇦🇹Austria🇦🇺Australia🇧🇪Belgium🇧🇬Bulgaria🇧🇷Brazil🇨🇦Canada🇨🇭Switzerland🇨🇱Chile🇨🇳China🇩🇪Germany🇩🇰Denmark🇩🇴Dominican Republic🇪🇬Egypt🇪🇸Spain🇫🇷France🇬🇧United Kingdom🇭🇺Hungary🇮🇩Indonesia🇮🇪Ireland🇮🇱Israel🇮🇳IndiaIran, Islamic Republic of🇮🇹Italy🇯🇴Jordan🇯🇵Japan🇰🇪Kenya🇰🇼Kuwait🇱🇹Lithuania🇱🇻LatviaMartinique🇲🇽Mexico🇲🇾Malaysia🇳🇪Niger🇳🇬Nigeria🇳🇱Netherlands🇳🇴Norway🇳🇿New Zealand🇵🇪Peru🇵🇭Philippines🇵🇱Poland🇵🇹Portugal🇶🇦QatarRussian Federation🇸🇪Sweden🇸🇬Singapore🇸🇮Slovenia🇸🇻El Salvador🇹🇭ThailandTaiwan, Province of China🇺🇸United States🇿🇦South AfricaGlobal