Rhysida Ransomware Gang

Actor Type	Criminal Group

Rhysida operate a 'ransomware-as-a-service' offering which was reportedly first observed in May 2023. Ransomware attacks using Rhysida typically employ the 'double extortion' approach - stealing data before encrypting systems and data. The group then request payment for access to a decryption key and to prevent exposure/sale of the stolen data.

Rhysida has extorted at least dozens of victims across multiple sectors and geographies.

Reports suggest that the criminal operation behind Rhysida has actually been active since 2021, being previously tracked under the name 'Gold Victor', and linked to the Vice Society ransomware operation.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

Rhysida Ransomware Gang Threat Reports

Report

StopRansomware: Rhysida Ransomware

This is a joint Cybersecurity Advisory by the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

Search:

ATT&CK ID	Title	Associated Tactics
T1486	Data Encrypted for Impact	Impact
T1564.003	Hidden Window	Defense Evasion
T1219	Remote Access Software	Command and Control
T1069.002	Domain Groups	Discovery
T1587	Develop Capabilities	Resource Development
T1021.004	SSH	Lateral Movement
T1657	Financial Theft	Impact
T1112	Modify Registry	Defense Evasion
T1190	Exploit Public-Facing Application	Initial Access
T1087.002	Domain Account	Discovery
T1021.001	Remote Desktop Protocol	Lateral Movement
T1059.003	Windows Command Shell	Execution
T1059.001	PowerShell	Execution
T1033	System Owner/User Discovery	Discovery
T1070.001	Clear Windows Event Logs	Defense Evasion
T1069.001	Local Groups	Discovery
T1078	Valid Accounts	Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1016	System Network Configuration Discovery	Discovery
T1566	Phishing	Initial Access
T1482	Domain Trust Discovery	Discovery
T1003.003	NTDS	Credential Access
T1055.002	Portable Executable Injection	Defense Evasion, Privilege Escalation
T1018	Remote System Discovery	Discovery
T1070.004	File Deletion	Defense Evasion

Showing 1 to 24 of 24 entries

Rhysida Ransomware Gang

Cyber Threat Graph Context

Rhysida Ransomware Gang Threat Reports

StopRansomware: Rhysida Ransomware

References

www.secureworks.com

www.logpoint.com

www.fortinet.com

www.fortinet.com

www.cisa.gov

www.logpoint.com

www.bl.uk

www.theguardian.com

MITRE ATT&CK Techniques