rhysida

314 tracked victims

·first seen 2023-06-05·last activity 2026-11-04

Activity analysis

HackerFeeds has tracked 316 victims claimed by rhysida since June 2023, most recently in November 2026 — ranking #23 of 332 groups (0.9% of all tracked ransomware victims). It posted 43 victims in the last 90 days, up 975% on the previous 90 days (4). Its most-targeted sector is Education (60 victims), followed by Healthcare (51). The United States accounts for 135 victims (53% of those with a known location); 61 victims did not disclose a location.

Victims per year

202378
202485
202594
202659

Top sectors

Education60
Healthcare51
Business Services33
Public Sector31
Manufacturing31
Technology18

Top countries

Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology

Group profile

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin. After encryption, the ransomware appends the extension '.ryshida' to encrypted files. Source: https://github.com/crocodyli/ThreatActors-TTPs

MITRE ATT&CK TTPs

TA0001

Initial Access

T1548.002Abusing Elevation Control Mechanism: Bypass User Account Control
Bypassing UAC for access.
T1566Phishing
Phishing for initial access.

TA0002

Execution

T1059Command and Scripting Interpreter
Using command interpreters for execution.
T1129Shared Modules
Using shared modules.

TA0003

Persistence

T1547.001Registry Run Keys / Startup Folder
Persistence via registry run keys.

TA0004

Privilege Escalation

T1055Process Injection
Injecting into processes for privilege escalation.
T1055.003Thread Execution Hijacking
Hijacking thread execution.
T1547.001Registry Run Keys
Using registry run keys.

TA0005

Defense Evasion

T1027Obfuscated Files or Information
Obfuscating files and information.
T1036Masquerading
Masquerading malicious files.
T1055Process Injection
Process injection for evasion.
T1055.003Thread Execution Hijacking
Thread execution hijacking.
T1497Virtualization/Sandbox Evasion
Evading virtualization/sandbox detection.
T1564Hidden Artifacts
Hiding artifacts.
T1564.004NTFS File Attributes
Using NTFS file attributes.
T1620Reflective DLL Injection
Reflective DLL injection.

TA0007

Discovery

T1010Application Window Discovery
Discovering application windows.
T1057Process Discovery
Discovering running processes.
T1082System Information Discovery
Discovering system information.
T1083File and Directory Discovery
Discovering files and directories.
T1497Virtualization/Sandbox Evasion
Detecting virtualization/sandbox.
T1518.001Security Software Discovery
Discovering security software.

TA0009

Collection

T1005Data from Local System
Collecting data from local system.
T1119Automated Collection
Automated data collection.

TA0010

Exfiltration

T1041Exfiltration Over C2 Channel
Exfiltrating data over C2 channel.

TA0011

Command and Control

T1071Application Layer Protocol
Using application layer protocols.
T1071.001Web Protocols
Using web protocols for C2.

TA0040

Impact

T1486Data Encrypted for Impact
Encrypting data for impact.

TA0042

Resource Development

T1583Acquire Infrastructure
Acquiring infrastructure for operations.
T1587Develop Capabilities
Developing malware capabilities.

TA0043

Reconnaissance

T1595Active Scanning
Scanning for vulnerable targets.
T1598Phishing for Information
Gathering information through phishing.

Recent victims

showing 50 of 314

Date	Website / victim	Sector	Country
2026-11-04	E El Cajon, CA	Not Found	US
2026-11-04	J Juge, Napolitano, Ruli, Putfark & Pittman	Professional Services
2026-11-03	H Here at Pope and Johnson County Title Company	Financial Services
2026-10-31	Phoenix Charter Academyphoenixcharteracademy.org	Education	US
2026-10-30	C Cipsa Industrias Sa De Cv	Manufacturing	MX
2026-10-30	I INTI International University & Colleges	Education	MY
2026-10-29	I INTAX, Inc.	Financial Services
2026-10-29	ClaimTek Systemsclaimtek.com	Financial Services
2026-10-28	Noelker and Hullnoelkerhull.com	Professional Services	US
2026-10-27	Machelen (Belgium)machelen.be	Not Found	BE
2026-10-26	M MISC Group	Energy & Utilities	MY
2026-10-23	S Sanders Law Group	Professional Services
2026-10-23	L Line2Line Coatings	Manufacturing
2026-10-22	D DR.SCHNELL GmbH & Co. KGaA	Manufacturing	DE
2026-10-11	R Reed & Giordano PA	Professional Services	US
2026-10-11	C Charles E. Tabor AAL LLC	Other	US
2026-10-10	Gress Clark Young & Schoeppergressandclarklaw.com	Professional Services	US
2026-10-09	Anne Arundel Countyaacounty.org	Government & Defense	US
2026-10-09	R RealManage	Professional Services	US
2026-10-03	Skaff Groupskaffgroup.com	Other
2026-10-02	M Mat Bao Corporation	Technology	VN
2026-10-02	E Electro Heat Sweden AB	Energy & Utilities	SE
2026-09-30	C clicks digital GmbH Information	Technology	DE
2026-09-30	L Law Offices of R. David Williams, P.A.	Professional Services	US
2026-09-24	N NEAD Pro	Not Found
2026-09-23	L Legis	Professional Services
2026-09-19	Kreishandwerkerschaft Borkenkh-borken.de	Professional Services	DE
2026-09-18	MPA Pharmampapharma.de	Healthcare	DE
2026-09-12	Axdia Internationalaxdia.com	Professional Services
2026-09-10	G General Santos Doctors Hospital	Healthcare	PH
2026-09-10	P Professional Retail Services	Retail & E-Commerce
2026-09-08	SAD'S Interimsads-interim.eu	Professional Services	FR
2026-09-07	R Rug & Home	Retail & E-Commerce	US
2026-09-01	S Szechenyi Programiroda Nonprofit Kf	Other	HU
2026-08-28	V Valley Health Team	Healthcare
2026-08-28	B Berlin, Germany	Not Found	DE
2026-08-22	CRI Electriccrielectric.com	Energy & Utilities	US
2026-08-21	F Fairview Dental Group	Healthcare	US
2026-08-21	Battle Creek Public Schoolsbattlecreekschools.net	Education	US
2026-08-14	Pierce Townshippiercetownship.org	Government & Defense	US
2026-08-13	SIA Medical Centresiamed.com.au	Healthcare	AU
2026-06-18	L Lawson Roofing	Manufacturing
2026-05-25	IDS Groupidsgi.com	Professional Services	US
2026-05-19	Landeshauptstadt Stuttgartstuttgart.de	Government & Defense	DE
2026-05-15	Tower View Primary Schooltowerview.staffs.sch.uk	Education	GB
2026-04-27	S Stelia North America	Manufacturing	US
2026-03-02	S Southold Town Senior ServicesSouthold Police Department	Government & Defense
2026-02-23	Rohnerrohnerspraybooths.com	Manufacturing	CH
2026-02-17	Cheyenne & Arapaho Tribescheyenneandarapaho-nsn.gov	Government & Defense	US
2026-02-12	Phoenix Art Museumphxart.org	Education	US