Rhysida · Threat actors

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin. After encryption, the ransomware appends the extension '.ryshida' to encrypted files.

It posted 94 listings in the last 12 months; the busiest month was October 2026 (41 listings).

Most targeted country: United States, with 143 listings (42% of the total).

Most targeted sector: Education, with 62 listings (18% of the total).

Targeted countries

Targeted sectors

VictimTribunal de Justica do Estado de Minas GeraisCountryBrazilSectorGovernment & DefenseListedNov 7, 2026

View listings that match your organization with the Intelligence 360 package

Showing 10 of 340 results

32 MITRE ATT&CK techniques across 12 stages are documented in the group's attacks.

1
Reconnaissance
Information about the target organization is gathered before the attack.
T1595Active ScanningT1598Phishing for Information
2
Resource development
Infrastructure, accounts and tools for the attack are prepared.
T1583Acquire InfrastructureT1587Develop Capabilities
3
Initial access
The attacker gets into the corporate network for the first time.
T1548.002Abusing Elevation Control Mechanism: Bypass User Account ControlT1566Phishing
4
Execution
Malicious code runs on the target system.
T1059Command and Scripting InterpreterT1129Shared Modules
5
Persistence
Access survives reboots and password changes.
T1547.001Registry Run Keys / Startup Folder
6
Privilege escalation
The attacker moves to accounts with higher privileges.
T1055Process InjectionT1055.003Thread Execution HijackingT1547.001Registry Run Keys
7
Defense evasion
Security software and logging are bypassed.
T1027Obfuscated Files or InformationT1036MasqueradingT1055Process InjectionT1055.003Thread Execution HijackingT1497Virtualization/Sandbox EvasionT1564Hidden ArtifactsT1564.004NTFS File AttributesT1620Reflective DLL Injection
8
Discovery
Systems, accounts and data on the network are mapped.
T1010Application Window DiscoveryT1057Process DiscoveryT1082System Information DiscoveryT1083File and Directory DiscoveryT1497Virtualization/Sandbox EvasionT1518.001Security Software Discovery
9
Collection
Data to be stolen is selected and gathered.
T1005Data from Local SystemT1119Automated Collection
10
Command and control
Compromised systems are controlled remotely.
T1071Application Layer ProtocolT1071.001Web Protocols
11
Exfiltration
Data is moved out of the organization; the threat to publish it in the listing relies on this data.
T1041Exfiltration Over C2 Channel
12
Impact
Systems are encrypted or services are stopped.
T1486Data Encrypted for Impact

What does a ransomware group do?

Ransomware groups break into corporate networks, move data out and encrypt systems. If the ransom is not paid, they list the organization on a leak site and threaten to publish the data.

How does Rhysida get into organizations?

The attacker gets into the corporate network for the first time.

T1548.002 · Abusing Elevation Control Mechanism: Bypass User Account Control
T1566 · Phishing

Which defenses matter most?

Priority defenses based on the documented techniques:

Keep internet-facing VPN, remote desktop and firewall interfaces patched, and require multi-factor authentication on these accounts.
Allow scripts and macros only for users who need them, and keep behavioral rules enabled in endpoint protection.
Monitor newly created services, scheduled tasks and startup entries.
Reduce local administrator accounts and perform privileged tasks from separate, monitored accounts.
Alert when security software is disabled or logs are cleared.
Monitor accounts that run many queries in a short time and unusual network scans.
Monitor large file archiving operations.
Block unapproved use of remote management tools.
Monitor unusual data volumes sent to cloud storage and file transfer services.
Keep offline, immutable backups and test restores regularly.

What should you do if your organization is listed on a leak site?

Record the listing and any published sample files; do not visit the leak site from the corporate network.
Isolate affected systems and preserve logs without deleting them.
Determine which data left the organization; if personal data is involved, review notification obligations with your legal team.
Make any decision about the ransom demand together with legal, management and incident response.
Do not bring systems back online before the attacker’s entry point is closed.

Is your organization mentioned?

Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.

Search your domain

Targeted countries

Targeted sectors

Reconnaissance

Resource development

Initial access

Execution

Persistence

Privilege escalation

Defense evasion

Discovery

Collection

Command and control

Exfiltration

Impact

Intelligence 360