Ransomware needs a way in. Stolen credentials are the cheapest one.
rhysida Ransomware Group
Ransomware group profile
73Victims
RussiaSource country
127Impact score
Description
Rhysida is a ransomware group that emerged in 2023, known for its double extortion tactics where it encrypts data and threatens public release unless ransoms are paid. The group employs sophisticated methods to infiltrate networks, primarily targeting critical sectors and leveraging a network of affiliates to maximize its impact.
Key insights
- •Utilizes multi-stage attack strategies including initial exploitation, data exfiltration, and ransomware deployment.
- •Employs double extortion tactics to pressurize victims into paying ransoms quickly.
- •Targets critical sectors such as healthcare and logistics to exploit the urgency of operations during breaches.
- •Utilizes legitimate tools like Cobalt Strike and PowerShell for post-exploitation activities.
- •Demands ransoms primarily in cryptocurrency, typically Bitcoin.
- •Clears forensic evidence by manipulating Windows event logs and deleting shadow copies as a defense evasion tactic.
Threat Level & Status Breakdown
For rhysida · Based on incidents in selected period
4.3threat level
Aggressiveness8/ 10
Lethality0.1/ 10
Criticality5.1/ 10
Status Breakdown
Data Leaked1.4%1
Claimed98.6%72
First seenOct 2025
Last seenOct 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedOct 7, 2026
Recent activity
Monthly attack count for rhysida in the selected period
73Total attacks
13peak in Sep
6.1avg / month
↓ 8 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for rhysida
- cb704d2e8df80fd3500a5b817966dc262d80ddb8
- f3a83cffc7187187f8e9d0863074e399
- 61ddf0d5915ecaab536abdcc3cfb5661558bb43f
- fa084ed28c01cab30e9994c71931ddb3424ef6e934dc4b4993d11d827635438c
- 746710470586076bb0757e0b3875de9c90202be2
- b3411927cc7cd05e02ba64b2a789bbde
- 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
- 28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f
- 39539766ae8f5256e6f21d853b8b7ea8f003d29f6d7cd57d1ecb621dc2b97c89
- 8251186b3196e3fefb0dbfcf71dfccc2c1cd66515686c9af8a6fb48766c739c6
- f02622129e7774b7673e2a9f62bb4a208d4a142b5d925532c7920481549bd07b
- 43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2
- 58c852525bf3bea185db34a79c2c5640c02f8291cdbdbe8dd7c0a9d4682f4b2c
- f613966b6ed1f080aacba005b1e48268ef662fffdf9894382299645f42900848
- 7d9f3701bf6f43ab84ce02ce4915dc0703504263db2e1eb65f4f7c791565f731
- fdd4e0bb2a4475e4e44154d7bf29490de98496553af3c8807f999ab8b920263f
- fe84a4a119917f15418659ed30699d873b6445aa053d9303287b085e35bf1002
- f6c7ecff7b07cba12bd79833a23d12d5fcd12a75a3394d923b994ba0ed535db3
- dee5915b76dd3bae3d3cedc0c1d1b055daab5852cba4868c92eb88b9a84a0b00
- 10d8e4ca3fa2902859c77f41baee4dda
- 26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b
- b26cfde4ca74d5d5377889bba5b60b5fc72dda75
- d1cd8c4574c3290ae16bf4e718c5e89dadef5b2fd4eea2211a19a6180ff8ee5b
- e86bb8361c436be94b0901e5b39db9b6666134f23cce1e5581421c2981405cb1
- 074d26b9b128be8e4a77d73dcac31307f28b0e8b8097622c02267be349fe4b4f
- 5627457a12c562b7a08f634878758d268b9fde44ce35292e887ca13741c5f942
- 62971070d6a8b9fca8a50b9cd8e91545bfcc2c2b6665f134c112081f54e6bf31
- 045c041354a6d6b47e91e1124a7dc77397c18e0695ccbc73f87b12a0a1079d46
- 37ff328175acd45ef27d3d339c3127a7612ad713fccd9c9aae01656dfbf13056
- 25a1d86248b7cf5f870dbc9960ce336266473bd40be3a8dcb35e6be88c9df261
- 9ff906ffcde32e4c6fb3ea4652e6d6326713a7fde8bb783b52f12a1f382f8798
- b9d0838be8952ebd4218c8f548ce94901f789ec1e32f5eaf46733f0c94c77999
- be2b45b7df8e7dea6fb6e72d776f41c50686c2c9cfbaf4d456bcc268f10ab083
- 8b9c7d2554fe315199fae656448dc193accbec162d4afff3f204ce2346507a8a
- 933acdb61d5d05bb55cd56957312b677719ac237a2daae0f1daf9d70dc68f2de
- 2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9
- 91270525521b7fe0d986db19747f47d34b6318ad
- dca83f08d448911a14c22ebcacc5ad57
- 3902165d0645afdb4b7d95f5cc55d65ecee17d3b77a31d51170e0beae3fd296a
- 6a58b52b184715583cda792b56a0a1ed
- 569d2b5701755260514fe1563d7530bb
- 025c1c35c3198e6e3497d5dbf97ae81f
- d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40
- 34ca75a8c190f20b8a7596afeb255f2228cb2467bd210b2637965b61ac7ea907
- eaca86a3f397d10d9188be9fcd2af1a7a30a9b573b2282b0b8300efeb5ff1efd
- f6e5f0ed974c89e2b4a47989fc987c79
- 282df7bcb720a5b6f409caf9ccda2f75
- 0e62d10ff194e84ed8c6bd71620f56ef9e557072
- 3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05
- a4f8ba563c8478a674fc8dff0a8d179adfb39f7dca143e73d139c814664fc419
- f2a3b52572a8a5da9cac1bf02427929acc101e5b9a2ae69093aad1c4f51d08c6
- c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f
- 26f41a46d0addde100bb9512a130de5e
- 9375cff0413111d3b88a00104b2a6676
- e11d147dad6e47a1cecb1f2755f95a55
- 6bffc6c7caa2eb2fa90fac0317f63338
- bd5354cd813130687c66ecc132d50770d48417cf
- 92c65b58c4925534c2ce78e54b0e11ecaf45ed8cf0344ebff46cdfc4f2fe0d84
- 4a692e244a389af0339de8c2d429b541d6d763afb0a2b1bb20bee879330f2f42
- b902954d634307260d5bd8fb6248271f933c1cbc649aa2073bf05e79c1aedb66
- 250e81eeb4df4649ccb13e271ae3f80d44995b2f8ffca7a2c5e1c738546c2ab1
- 59a9ca795b59161f767b94fc2dece71a
- 20c730c7033b5bdc0a6510825e90449ba8f87942d2d7f61fa1ba5f100e98c141
- 36d6655962cfded3a8a170b6f09dac5f7a39e65fdd3007c5532ae744da4f6aab
- 09793a85d372f044fe53c4b47c47049c6bc13d1141334727800b2e32e6d92342
- 29efd64dd3c7fe1e2b022b7ad73a1ba5
- e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
- a26f0a2da63a838161a7d335aaa5e4b314a232acc15dcabdb6f6dbec63cda642
- 54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b
- 5537c708edb9a2c21f88e34e8a0f1744
- 86233a285363c2a6863bf642deab7e20f062b8eb
- 4fdabe571b66ceec3448939bfb3ffcd1
- 763499b37aacd317e7d2f512872f9ed719aacae1
- 0c8e88877383ccd23a755f429006b437
- 576d07cc8919c68914bf08663e0afd00d9f9fbf5263b5cccbded5d373905a296
- f3abb0cc802f3d7b95fc8762b94bdcb13bf39634c40c357301c4aa1d67a256fb
- 80104e0ad490b44a632a15e5875e7626db7f35fa94d7aadf19c45a621d75c7e0
- 132870a1ae6a0bdecaa52c03cfe97a47df8786f148fa8ca113ac2a8d59e3624a
- dd95377842932d77e225b126749e1e6e8ecd6f5c6540d084a551a80a54d02d7d
- 21ab4357262993a042c28c1cdb52b2dab7195a6c30fa8be723631604dd330b29
- b46949feeda8726c0fb86d3cd32d3f3f53f6d2e6e3fcd6f893a76b8b2632b249
- b766522dd4189fef7775d663e5649ba9d8be8e03022039d20848fcbc3643e5f2
- d3606e2e36db0a0cb1b8168423188ee66332cae24fe59d63f93f5f53ab7c3029
- 857e2f63a1078d49adc59a03482f7b362563f16fb251f174bdaa7759ed47922a
- 4f1b8c9209fa2684aa3777353222ad1c7716910dbb615d96ffc7882eb81dd248
- e391c2d3e8e4860e061f69b894cf2b1ba578a3e91de610410e7e9fa87c07304c
- c0976a1fbc3dd938f1d2996a888d0b3a516b432a2c38d788831553d81e2f5858
- 4afd9f0dde092daeac3f3e6ffb0aee06682b3dba6005d2bd1a914eefd5cc6a30
- a6020794bd6749e0765966cd65ca6d5511581f47cc2b38e41cb1e7fddaa0b221
- 722fff8f38197d1449df500ae31a95bb34a6ddaba56834b13eaaff2b0f9f1c8b
- 597de376b1f80c06d501415dd973dcec
- 4d97497247e65144814d99eb0dab77d39f4863058dd1109637d5be39be082c57
- 703a8460e1a86145c1d13ad75c6c31d101e1618cb7c56a2b0e14a56f0c585287
- 867a91a0d1d0a8c6fe8431bd1c3764c3
- bab3c87cac6db1700f0a0babaa31f5cd544961d1b9ec03fd8bcdeff837fc9755
- 54416fc42afa9b09ea7e8d8e318f4891
- 93be893ff74816c49f2706f222789027
- d86383882515b7a9218d5f69924feadf
- ae6eb3cce06f666934e03dd46269526e56aff3b1
- 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f
- 2b825ea77e240d2ab6b6695a602cb07c
- 7cfba113342f78b5909f606c26fc1dc4
- ddaa09b5c3bf5aa24e300c24905469f2
- 6dd8c26f64df37d0c7645b63c9bba51f
- b0cfa2089802634ffb8c77962cdb18317a6332d4
- 64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983
- edbf152ed9ac79e5d9e0111d1071af48
- 44c7d18633b5741db270a6bd378b6f3c
- d5c2f87033a5baeeb1b5b681f2c4a156ff1c05ccd1bfdaf6eae019fc4d5320ee
- 1e256229b58061860be8dbf0dc4fe67e
- d345e1d251714508a28544dc00e5950b05116ce1
- 1845a910dcde8c6e45ad2e0c48439e5ab8bbbeb731f2af11a1b7bbab3bfe0127
- 7cbf2951f13cd54abd951b1d289e2655
- 1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069
- 3928c5874249cc71b2d88e5c0c00989ac394238747bb7638897fc210531b4aab
- b88f173337ab103181feb33681f0b297
- 6287004d7d40d23809273abde38101a580906db8
- fae1061813f2148296767d28262d2c25
- c7d994eb2042633172bd8866c9f163be531444ce3126d5f340edd25cbdb473d4
- b365af317ae730a67c936f21432b9c71
- a0bdfac3ce1880b32ff9b696458327ce352e3b1d
- e936445935c4a636614f7113e4121695a5f3e4a6c137b7cdcceb6f629aa957c4
- 52c6326af893e3baa1c43c59827f61eb
- e97bdf7fafb1cb2a2bf0a4e14f51e18a34f3ff2f6f7b99731e93070d50801bef
- 1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c
- ffa28db79daca3b93a283ce2a6ff24791956a768cb5fc791c075b638416b51f4
- 2833c82055bf2d29c65cd9cf6684449a
- a53a9ca8a074c7108f8412c3f8c1fc5d
- 6c6e7eda17d7296d5c0c0cda8db200d0248c14f8682cbd7d3ffff110916e3cf2
- 77ec63bda74bd0d0e0426dc8f8008506
- 46f227d962a503eb6276f99d63b891e8de60a1eaf02c768ac4b0aba2e3ac5d56
- a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6
- e0ae6b6cfd6544a02517e91b74bda9d5cb98674dc04609743de012354c2cdf22
- 17fb52476016677db5a93505c4a1c356984bc1f6a4456870f920ac90a7846180
- 10955a02ef3fd3f80f20062c401bf7960ff6ce94
- e736229e890a138ccf7810e00a6bb50d
- 188d0220bc3adeb53e70ea6fd57ac87aaad367af86323b7f7ac030af555077dc
- b8cc6a24915ae61642ad9d0200291c50c47e2d0a6c4549072a14c019bb5260fc
- ed3cc2c262d38c32bf6a789b5af0f5652497927b
- 8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef
- 0edffd2d6933146b600d1578f4654be6
- 97d61059ae372ee9f9bcba115c8269bba3cdad73
- 8c57b97b04d7eabbae651c3400a5e6b897aea1ae8964507389340c44b99c523a
- 5410539e34fb934133d6c689072ba49d
- e36469145749addf8d9b235ddd655bdb62d67b83
- fb9ab37dfed2c2c8db82cc0c25e4fa7c
- 09bd833782a6b2cccdd3285ad12f23bedb1dbb77
- e8d3aeea7617982bb6e484a9f8307e6b
- 24e3af0612ac12377220f86623a8094bf136c646
- 94b0cfa3c654f17562a62541238ff6bb
- 94aa7417f388c61a2d63ddcba6efec80c55f8555
- e2919dea773eb0796e46e126dbce17b1
- 69d58a5ff2c0343119816d34ce9da8d9bc6f47c9
- 3e993dfe5ce90dadb0cf0707d260febd
- 603712012545314a2f3d2f6f21e00d206a24f1fb
- f97bf76439175ff3f09758bfe0a1a1f4
- 1d20ea757b8d5954418363bed5153144c1e19440
- a395e3053eabada168f6e82134078185
- 69c0e6ad69fc1def6107d3ee83c1f5161df03b5e
- c341d93161a6db36d22215fa594d0b3c
- 5e1f8e2c9421b3f7caba07ae6be503d272ebb8eb
- 128409d5cb9701cd12600baf7a623794
- aa7980d0c957891cc6620d70da2ea60a04794439cd6c7fd1ac9dd68ba8b1b7c8
- 1374cb6a9bdcc5ac4e9d2bcf60aeea14336f32f45b33b60e90baca2a22edc6ee
- 10370f821ef2d769bcb287b3f5ab081c4949a97891a25a23688e8c553bd393df
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for rhysida
CVE-2025-5777
CVE-2022-3236
CVE-2022-30190
CVE-2022-26134
CVE-2020-1472
CVE-2018-0798
Collection
T1005
Data from Local System
T1119
Automated Collection
Defense Evasion
T1027
Obfuscated Files or Information
T1036
Masquerading
T1055.003_1
Thread Execution Hijacking
T1055_1
Process Injection
T1497
Virtualization/Sandbox Evasion
T1564
Hide Artifacts
T1564.004
NTFS File Attributes
T1620
Reflective Code Loading
Discovery
T1010
Application Window Discovery
T1057
Process Discovery
T1082
System Information Discovery
T1083
File and Directory Discovery
T1497_2
Virtualization/Sandbox Evasion
T1518.001
Security Software Discovery
Execution
T1059
Command and Scripting Interpreter
T1129
Shared Modules
Impact
T1486
Data Encrypted for Impact
Persistence
T1547.001
Registry Run Keys / Startup Folder
Privilege Escalation
T1055
Process Injection
T1055.003
Thread Execution Hijacking
T1547.001_1
Registry Run Keys / Startup Folder
Victims(73)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Skaff Group | Lebanon | Claimed | 5 days ago | |
| Mat Bao Corporation | Vietnam | Claimed | 5 days ago | |
| Electro Heat Sweden AB | Sweden | Claimed | 5 days ago | |
| clicks digital GmbH | Germany | Claimed | 8 days ago | |
| Law Offices of R. David Williams, P.A. | United States | Claimed | 8 days ago | |
| NEAD SRL | Italy | Claimed | 13 days ago | |
| NEAD Pro | Italy | Claimed | 13 days ago | |
| Legis | Colombia | Claimed | 15 days ago | |
| Kreishandwerkerschaft Borken | Germany | Claimed | 19 days ago | |
| MPA Pharma GmbH | Germany | Claimed | 20 days ago | |
| Axdia International | Germany | Claimed | 26 days ago | |
| General Santos Doctors Hospital | Philippines | Claimed | 27 days ago | |
| Professional Retail Services | United States | Claimed | 27 days ago | |
| SAD'S Interim | France | Claimed | 30 days ago | |
| Rug & Home | United States | Claimed | about 1 month ago | |
| Szechenyi Programiroda Nonprofit Kf | Hungary | Claimed | about 1 month ago | |
| Valley Health Team | United States | Claimed | about 1 month ago | |
| Berlin, Germany | Germany | Data Leaked | about 1 month ago | |
| CRI Electric, Inc | United States | Claimed | about 2 months ago | |
| Coming soon | — | Claimed | about 2 months ago |
United StatesProfessional Servicesdwilliamslaw.com
Claimed
8 days agoPage 1 of 4
Affected countries(57)
Countries where this group has been reported to target or leak victims.
🇦🇪United Arab Emirates🇦🇷Argentina🇦🇹Austria🇦🇺Australia🇧🇪Belgium🇧🇬Bulgaria🇧🇷Brazil🇨🇦Canada🇨🇭Switzerland🇨🇱Chile🇨🇳China🇨🇴Colombia🇩🇪Germany🇩🇰Denmark🇩🇴Dominican Republic🇪🇬Egypt🇪🇸Spain🇫🇷France🇬🇧United Kingdom🇭🇺Hungary🇮🇩Indonesia🇮🇪Ireland🇮🇱Israel🇮🇳IndiaIran, Islamic Republic of🇮🇹Italy🇯🇴Jordan🇯🇵Japan🇰🇪Kenya🇰🇼Kuwait🇱🇧Lebanon🇱🇹Lithuania🇱🇻LatviaMartinique🇲🇽Mexico🇲🇾Malaysia🇳🇪Niger🇳🇬Nigeria🇳🇱Netherlands🇳🇴Norway🇳🇿New Zealand🇵🇪Peru🇵🇭Philippines🇵🇱Poland🇵🇹Portugal🇶🇦QatarRussian Federation🇸🇪Sweden🇸🇬Singapore🇸🇮Slovenia🇸🇻El Salvador🇹🇭ThailandTaiwan, Province of China🇺🇸United States🇻🇳Vietnam🇿🇦South AfricaGlobal