rhysida
Group profile
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.<br> <br> The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.<br> <br> The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.<br> <br> After encryption, the ransomware appends the extension '.ryshida' to encrypted files.<BR>Source: https://github.com/crocodyli/ThreatActors-TTPs
MITRE ATT&CK TTPs
Initial Access
Execution
Persistence
T1547.001Registry Run Keys / Startup Folder
Persistence via registry run keys.
Privilege Escalation
Defense Evasion
T1027Obfuscated Files or Information
Obfuscating files and information.
T1036Masquerading
Masquerading malicious files.
T1055Process Injection
Process injection for evasion.
T1055.003Thread Execution Hijacking
Thread execution hijacking.
T1497Virtualization/Sandbox Evasion
Evading virtualization/sandbox detection.
T1564Hidden Artifacts
Hiding artifacts.
T1564.004NTFS File Attributes
Using NTFS file attributes.
T1620Reflective DLL Injection
Reflective DLL injection.
Discovery
T1010Application Window Discovery
Discovering application windows.
T1057Process Discovery
Discovering running processes.
T1082System Information Discovery
Discovering system information.
T1083File and Directory Discovery
Discovering files and directories.
T1497Virtualization/Sandbox Evasion
Detecting virtualization/sandbox.
T1518.001Security Software Discovery
Discovering security software.
Collection
Exfiltration
T1041Exfiltration Over C2 Channel
Exfiltrating data over C2 channel.
Command and Control
Impact
T1486Data Encrypted for Impact
Encrypting data for impact.
Resource Development
Recent victims
showing 50 of 288| Date | Website / victim | Sector | Country |
|---|---|---|---|
| 2026-09-19 |  Kreishandwerkerschaft Borkenkh-borken.de | Professional Services | DE |
| 2026-09-18 |  MPA Pharmampapharma.de | Healthcare | DE |
| 2026-09-12 |  Axdia Internationalaxdia.com | Professional Services | |
| 2026-09-10 | G General Santos Doctors Hospital | Healthcare | PH |
| 2026-09-10 | P Professional Retail Services | Retail & E-Commerce | |
| 2026-09-08 |  SAD'S Interimsads-interim.eu | Professional Services | FR |
| 2026-09-07 | R Rug & Home | Retail & E-Commerce | US |
| 2026-09-01 | S Szechenyi Programiroda Nonprofit Kf | Other | HU |
| 2026-08-28 | V Valley Health Team | Healthcare | |
| 2026-08-28 | B Berlin, Germany | Not Found | DE |
| 2026-08-22 |  CRI Electriccrielectric.com | Energy & Utilities | US |
| 2026-08-21 | F Fairview Dental Group | Healthcare | US |
| 2026-08-21 |  Battle Creek Public Schoolsbattlecreekschools.net | Education | US |
| 2026-08-14 |  Pierce Townshippiercetownship.org | Government & Defense | US |
| 2026-08-13 |  SIA Medical Centresiamed.com.au | Healthcare | AU |
| 2026-06-18 | L Lawson Roofing | Manufacturing | |
| 2026-05-25 |  IDS Groupidsgi.com | Professional Services | US |
| 2026-05-19 |  Landeshauptstadt Stuttgartstuttgart.de | Government & Defense | DE |
| 2026-05-15 |  Tower View Primary Schooltowerview.staffs.sch.uk | Education | GB |
| 2026-04-27 | S Stelia North America | Manufacturing | US |
| 2026-03-02 | S Southold Town Senior ServicesSouthold Police Department | Government & Defense | |
| 2026-02-23 |  Rohnerrohnerspraybooths.com | Manufacturing | CH |
| 2026-02-17 |  Cheyenne & Arapaho Tribescheyenneandarapaho-nsn.gov | Government & Defense | US |
| 2026-02-12 |  Phoenix Art Museumphxart.org | Education | US |
| 2026-02-06 | L Leading Edge Speciali | Professional Services | |
| 2026-02-04 |  Lakeside Union School Districtlsusd.net | Education | US |
| 2026-02-02 |  Elabselabs.de | Technology | SE |
| 2026-01-29 |  MACT Health Boardmacthealth.org | Healthcare | US |
| 2026-01-25 |  Cytek Biosciencescytekbio.com | Healthcare | US |
| 2026-01-21 |  Jet-care Internationaljet-care.com | Transportation | CH |
| 2026-01-06 |  Charles Leonard Steel Servicescharlesleonardsteelservices.com | Manufacturing | US |
| 2025-12-30 |  Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metricsfalkwaas.com | Professional Services | US |
| 2025-12-19 |  Larry Pitt & Associateslarrypitt.com | Professional Services | US |
| 2025-12-15 |  YOKOSUKA GAKUINyokosuka-gakuin.ac.jp | Education | JP |
| 2025-12-13 | * ***** *********** | Not Found | |
| 2025-12-12 |  United Keetoowah Band of Cherokee Indians in Oklahomaukbb-nsn.gov | Government & Defense | US |
| 2025-12-11 |  Woodard, Emhardt, Henry, Reeves & Wagner, LLPuspatent.com | Professional Services | US |
| 2025-12-11 |  Harbour Town Doctorsharbourtowndoctors.com.au | Healthcare | AU |
| 2025-12-07 |  Kane's Furniturekanes.com | Retail & E-Commerce | US |
| 2025-12-06 |  SODISEsodise.com | Professional Services | FR |
| 2025-12-03 |  Bo Beuckman Fordbobeuckmanford.com | Retail & E-Commerce | US |
| 2025-12-02 |  Cleveland County Sheriff's Officecso-ok.us | Government & Defense | US |
| 2025-11-26 | A AGS | Not Found | |
| 2025-11-25 |  Marlex Human Capitalmarlexhc.pl | Professional Services | PL |
| 2025-11-24 |  Collge Superieur De Montrealcsmontreal.ca | Education | CA |
| 2025-11-22 |  St. Joseph's Healthcare Hamiltonstjoes.ca | Healthcare | CA |
| 2025-11-21 |  Wachusett School District MAwrsd.net | Education | US |
| 2025-11-18 |  Smoll & Banning, CPAssmollandbanning.com | Financial Services | US |
| 2025-11-10 |  Heart South Cardiovascular Groupheartsouthpc.com | Healthcare | US |
| 2025-11-10 |  LMHT Associateslmht.com | Not Found | US |