Overview
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin. After encryption, the ransomware appends the extension '.ryshida' to encrypted files.
What public reporting says
- Emerged in May 2023, just as Vice Society went quiet. Check Point and others judge it to be Vice Society rebranded: same education focus, same tooling such as SystemBC, and the same exclusion of Russia and CIS countries. Russian comments in its code support a Russian-speaking origin.
Check Point Research · Wikipedia
Geography: origin and targets
Assessed origin: Russian Federation. Judged to be the rebranded Vice Society; Russian comments in its code and the same exclusion of Russia and CIS countries. Attribution is uncertain: read it as an assessment, not proof.
United States of America130
Canada20
Germany12
United Kingdom10
Australia8
Italy8
Switzerland6
Brazil5
Japan3
Argentina3
Exploited vulnerabilities
| Vendor | Product | CVE | Category | Source |
|---|---|---|---|---|
| Windows | NetLogon | CVE-2020-1472 | Microsoft | cisa.gov, cisa.gov, cisa.gov, cisa.gov, cisa.gov, thedfirreport.com, thedfirreport.com, cisa.gov, cisa.gov, welivesecurity.com, cisa.gov, thedfirreport.com, checkpoint.com |
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
Technique details
Initial Access (TA0001)
- T1548.002 · Abusing Elevation Control Mechanism: Bypass User Account Control: Bypassing UAC for access.
- T1566 · Phishing: Phishing for initial access.
Execution (TA0002)
- T1059 · Command and Scripting Interpreter: Using command interpreters for execution.
- T1129 · Shared Modules: Using shared modules.
Persistence (TA0003)
- T1547.001 · Registry Run Keys / Startup Folder: Persistence via registry run keys.
Privilege Escalation (TA0004)
- T1055 · Process Injection: Injecting into processes for privilege escalation.
- T1055.003 · Thread Execution Hijacking: Hijacking thread execution.
- T1547.001 · Registry Run Keys: Using registry run keys.
Defense Evasion (TA0005)
- T1027 · Obfuscated Files or Information: Obfuscating files and information.
- T1036 · Masquerading: Masquerading malicious files.
- T1055 · Process Injection: Process injection for evasion.
- T1055.003 · Thread Execution Hijacking: Thread execution hijacking.
- T1497 · Virtualization/Sandbox Evasion: Evading virtualization/sandbox detection.
- T1564 · Hidden Artifacts: Hiding artifacts.
- T1564.004 · NTFS File Attributes: Using NTFS file attributes.
- T1620 · Reflective DLL Injection: Reflective DLL injection.
Discovery (TA0007)
- T1010 · Application Window Discovery: Discovering application windows.
- T1057 · Process Discovery: Discovering running processes.
- T1082 · System Information Discovery: Discovering system information.
- T1083 · File and Directory Discovery: Discovering files and directories.
- T1497 · Virtualization/Sandbox Evasion: Detecting virtualization/sandbox.
- T1518.001 · Security Software Discovery: Discovering security software.
Collection (TA0009)
- T1005 · Data from Local System: Collecting data from local system.
- T1119 · Automated Collection: Automated data collection.
Exfiltration (TA0010)
- T1041 · Exfiltration Over C2 Channel: Exfiltrating data over C2 channel.
Command and Control (TA0011)
- T1071 · Application Layer Protocol: Using application layer protocols.
- T1071.001 · Web Protocols: Using web protocols for C2.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: Encrypting data for impact.
Resource Development (TA0042)
- T1583 · Acquire Infrastructure: Acquiring infrastructure for operations.
- T1587 · Develop Capabilities: Developing malware capabilities.
Reconnaissance (TA0043)
- T1595 · Active Scanning: Scanning for vulnerable targets.
- T1598 · Phishing for Information: Gathering information through phishing.
Tools
- PowerView
- WinSCP
- NTDS Utility (ntdsutil)
- PsExec
- WMIC
- Windows Event Utility (wevtutil)
- Impacket
- AnyDesk
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| — | DLS | rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad[.]onion | Yes |
| Rhysida | DLS | rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11