rhysida
Group profile
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.<br> <br> The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.<br> <br> The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.<br> <br> After encryption, the ransomware appends the extension '.ryshida' to encrypted files.<BR>Source: https://github.com/crocodyli/ThreatActors-TTPs
MITRE ATT&CK TTPs
Initial Access
Execution
Persistence
T1547.001Registry Run Keys / Startup Folder
Persistence via registry run keys.
Privilege Escalation
Defense Evasion
T1027Obfuscated Files or Information
Obfuscating files and information.
T1036Masquerading
Masquerading malicious files.
T1055Process Injection
Process injection for evasion.
T1055.003Thread Execution Hijacking
Thread execution hijacking.
T1497Virtualization/Sandbox Evasion
Evading virtualization/sandbox detection.
T1564Hidden Artifacts
Hiding artifacts.
T1564.004NTFS File Attributes
Using NTFS file attributes.
T1620Reflective DLL Injection
Reflective DLL injection.
Discovery
T1010Application Window Discovery
Discovering application windows.
T1057Process Discovery
Discovering running processes.
T1082System Information Discovery
Discovering system information.
T1083File and Directory Discovery
Discovering files and directories.
T1497Virtualization/Sandbox Evasion
Detecting virtualization/sandbox.
T1518.001Security Software Discovery
Discovering security software.
Collection
Exfiltration
T1041Exfiltration Over C2 Channel
Exfiltrating data over C2 channel.
Command and Control
Impact
T1486Data Encrypted for Impact
Encrypting data for impact.
Resource Development
Recent victims
showing 50 of 273| Date | Website / victim | Sector | Country |
|---|---|---|---|
| 2026-06-18 | L Lawson Roofing | Construction | |
| 2026-05-25 |  IDS Groupidsgi.com | Not Found | US |
| 2026-05-19 |  Landeshauptstadt Stuttgartstuttgart.de | Public Sector | DE |
| 2026-05-15 |  Tower View Primary Schooltowerview.staffs.sch.uk | Education | GB |
| 2026-04-27 | S Stelia North America | Manufacturing | US |
| 2026-03-02 | S Southold Town Senior ServicesSouthold Police Department | Public Sector | |
| 2026-02-23 |  Rohnerrohnerspraybooths.com | Manufacturing | CH |
| 2026-02-17 |  Cheyenne & Arapaho Tribescheyenneandarapaho-nsn.gov | Public Sector | US |
| 2026-02-12 |  Phoenix Art Museumphxart.org | Education | US |
| 2026-02-06 | L Leading Edge Speciali | Business Services | |
| 2026-02-04 |  Lakeside Union School Districtlsusd.net | Education | US |
| 2026-02-02 |  Elabselabs.de | Technology | SE |
| 2026-01-29 |  MACT Health Boardmacthealth.org | Healthcare | US |
| 2026-01-25 |  Cytek Biosciencescytekbio.com | Healthcare | US |
| 2026-01-21 |  Jet-care Internationaljet-care.com | Transportation/Logistics | CH |
| 2026-01-06 |  Charles Leonard Steel Servicescharlesleonardsteelservices.com | Manufacturing | US |
| 2025-12-30 |  Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metricsfalkwaas.com | Business Services | US |
| 2025-12-19 |  Larry Pitt & Associateslarrypitt.com | Business Services | US |
| 2025-12-15 |  YOKOSUKA GAKUINyokosuka-gakuin.ac.jp | Education | JP |
| 2025-12-13 | * ***** *********** | Not Found | |
| 2025-12-12 |  United Keetoowah Band of Cherokee Indians in Oklahomaukbb-nsn.gov | Public Sector | US |
| 2025-12-11 |  Woodard, Emhardt, Henry, Reeves & Wagner, LLPuspatent.com | Business Services | US |
| 2025-12-11 |  Harbour Town Doctorsharbourtowndoctors.com.au | Healthcare | AU |
| 2025-12-07 |  Kane's Furniturekanes.com | Consumer Services | US |
| 2025-12-06 |  SODISEsodise.com | Business Services | FR |
| 2025-12-03 |  Bo Beuckman Fordbobeuckmanford.com | Consumer Services | US |
| 2025-12-02 |  Cleveland County Sheriff's Officecso-ok.us | Public Sector | US |
| 2025-11-26 | A AGS | Not Found | |
| 2025-11-25 |  Marlex Human Capitalmarlexhc.pl | Business Services | PL |
| 2025-11-24 |  Collge Superieur De Montrealcsmontreal.ca | Education | CA |
| 2025-11-22 |  St. Joseph's Healthcare Hamiltonstjoes.ca | Healthcare | CA |
| 2025-11-21 |  Wachusett School District MAwrsd.net | Education | US |
| 2025-11-18 |  Smoll & Banning, CPAssmollandbanning.com | Financial Services | US |
| 2025-11-10 |  Heart South Cardiovascular Groupheartsouthpc.com | Healthcare | US |
| 2025-11-10 |  LMHT Associateslmht.com | Not Found | US |
| 2025-11-05 |  KISS FMkissfm.es | Telecommunication | ES |
| 2025-11-04 |  Automated Logistics Systemsautomatedlogistics.com | Transportation/Logistics | US |
| 2025-11-04 |  Invacareinvacare.com | Healthcare | US |
| 2025-10-30 |  Spindletop Centerspindletop.org | Healthcare | US |
| 2025-10-28 |  Gemini Groupgeminigroup.net | Not Found | US |
| 2025-10-28 |  Bellflower Unified School Districtbellsd.org | Education | US |
| 2025-10-27 |  Abilene Family Medical Associatesabilenedocs.com | Healthcare | US |
| 2025-10-21 |  Perasoperasotech.com | Technology | CA |
| 2025-10-17 |  Hematology Oncology Consultantshocpc.com | Healthcare | US |
| 2025-10-17 | Business Services | DE | |
| 2025-10-16 |  Sibbaldssibbalds.co.uk | Business Services | GB |
| 2025-10-15 |  Tex-Tubetex-tube.com | Manufacturing | US |
| 2025-10-13 |  Furuno Electricfuruno.com | Technology | JP |
| 2025-10-09 |  Sdii Globalsdii-global.com | Business Services | US |
| 2025-10-07 |  JASCO Applied Sciencesjasco.com | Technology | CA |
