Rhysida

Overview

Rhysida first appeared in May 2023, though samples analyzed later place its earliest activity in January 2023. Within months of public emergence the group went from what researchers initially described as "novice malware" to a sophisticated double-extortion operation targeting critical infrastructure — a trajectory that, combined with significant TTP overlap with Vice Society, led Sophos, Check Point, and Microsoft to conclude that Rhysida represents Vice Society operators adopting a new platform rather than an entirely new criminal organization.

The Vice Society connection is well-evidenced. Sophos tracks the activity cluster as TAC5279, which it first observed using Vice Society ransomware in November 2022. The same cluster switched to deploying Rhysida in June 2023 — precisely when Vice Society's leak site went quiet after posting victims consistently since 2021. The timing of Vice Society's last victim post and Rhysida's first victim post in mid-2023 forms a near-seamless handoff. Shared tooling — particularly the use of SystemBC for C2, consistent PowerShell scripting patterns, and AnyDesk as the preferred RMM tool — reinforces that these are the same operators with a new payload. CISA's advisory explicitly notes the similarity and cross-references the Vice Society advisory.

Rhysida takes its name from the Rhysida genus of centipedes — an apparent reference to stealth and operating in shadows. The group brands itself as a "cybersecurity team" in ransom communications, framing attacks as penetration tests and advising victims to "reach out as soon as possible to stop the leakage of your confidential information to the public." This theatrical framing is consistent with Vice Society's prior communications style.

One technically significant event in Rhysida's history is the February 2024 publication of a decryptor tool by South Korean researchers from Kookmin University and KISA. They discovered a vulnerability in Rhysida's ChaCha20-based CSPRNG implementation — the encryption key seed was derived from system time using the C standard library's rand() function, making keys predictable and recoverable. Avast had independently discovered the flaw in August 2023 and privately provided decryption to victims for months. KISA released the tool publicly in February 2024, likely prompting Rhysida to patch the cryptographic vulnerability in subsequent builds. The group's continued activity after the decryptor's publication confirms an updated payload was deployed.

The April 30, 2025 CISA advisory update added new IOCs from investigations as recently as December 2024 and introduced documentation of new initial access vectors including Gootloader delivery and AZCopy/StorageExplorer for cloud data exfiltration — confirming ongoing operational evolution. The update also flagged similarities between Rhysida and the emerging Interlock ransomware variant. Notably, CISA's own joint advisory on Interlock ransomware (AA25-203A, July 2025) explicitly cross-references the Rhysida advisory and states that authoring agencies are aware of open-source reporting detailing code and technique similarities between the two variants — placing the Rhysida/Interlock relationship on official record rather than as researcher speculation alone.

Target Profile

CISA describes Rhysida as targeting "victims of opportunity" — organizations that present accessible attack surfaces rather than highly specific sector mandates. That said, the victim portfolio shows consistent preference for sectors with high-value sensitive data and regulatory pressure to restore operations quickly.

• Healthcare: A primary growth sector for Rhysida, inherited from Vice Society's playbook. Prospect Medical Holdings — a California-based conglomerate operating 17 hospitals and 166 clinics across multiple states — was hit in 2023, with 1.3 TB of SQL databases and 1 TB of documents exfiltrated. In 2024, at least 68 healthcare organizations were targeted using Cobalt Strike in the attack chain. Healthcare victims face life-safety pressure to restore systems quickly, regulatory exposure under HIPAA, and hold high-value patient data — all factors that maximize payment pressure.
• Education: A Vice Society specialty inherited by Rhysida. Universities, school districts, and K-12 systems are consistently targeted. These organizations hold sensitive student and staff data, often run complex distributed networks with limited security budgets, and face significant public accountability pressure. The Vice Society playbook of targeting education — which accounted for 38.4% of Vice Society's attacks — is reflected in Rhysida's continued focus on the sector.
• Government and Public Sector: Municipal governments, transportation agencies, and public institutions appear regularly on Rhysida's leak site. The City of Columbus (Ohio), Maryland Transit Administration, Port of Seattle / Seattle-Tacoma International Airport, Oregon Department of Environmental Quality, and the Chilean Army are among confirmed government victims. The Port of Seattle attack generated Rhysida's largest ever ransom demand of $5.8 million; Rhysida's average demand across confirmed incidents is approximately $1.1 million. Public sector organizations face reputational pressure that heightens ransom leverage, and their data — including law enforcement records and emergency services access — commands high dark web auction values.
• Manufacturing and IT: Consistent with CISA's advisory targeting profile. Supply chain-adjacent organizations and managed service providers are targeted both for direct extortion and for the downstream access their compromise can enable.
• Cultural and Media institutions: The British Library and Insomniac Games attacks demonstrated Rhysida's willingness to target high-profile cultural and entertainment institutions. The reputational damage of a major cultural institution losing a decade of digital infrastructure — and a major game studio having unreleased Marvel IP dumped publicly — generates media coverage that amplifies the group's notoriety and future leverage.

Tactics, Techniques & Procedures

TTPs sourced from CISA advisory AA23-319A (updated April 30, 2025), Sophos incident response analysis (TAC5279 cluster), and field reporting. Rhysida operates as both a closed operation and a RaaS model with affiliates; individual affiliate TTPs vary but the core toolchain and extortion model are consistent.

mitre id	technique	description
T1133	External Remote Services	VPN access is the primary initial access vector. Rhysida actors leverage internet-facing VPN services — both via phishing-harvested credentials and by exploiting known CVEs (notably ZeroLogon CVE-2020-1472 against domain controllers). The British Library attack was initiated via a VPN vulnerability that allowed bypassing the perimeter firewall.
T1566	Phishing	Phishing emails used for both initial access and Cobalt Strike payload delivery. In 2025, Gootloader — delivered via SEO poisoning (malicious websites ranking for software download searches) — was added as an initial access vector, providing trojanized software installers that deploy backdoor access.
T1059.001	PowerShell	Extensive PowerShell use for discovery, credential harvesting support, defense evasion, and payload staging. Documented PowerShell scripts systematically disable and stop security-related services including SQL, Oracle, Exchange, Veeam backup, Hyper-V, Malwarebytes, and antivirus processes before encryption.
T1105	Ingress Tool Transfer	Malicious executables staged in created folders C:\in and C:\out on compromised systems — a documented Rhysida actor staging pattern. Tools transferred to compromised hosts include Cobalt Strike beacons, credential harvesting utilities, and the Rhysida encryptor binary.
T1003.001	OS Credential Dumping: LSASS Memory	Secretsdump used for credential harvesting. Combined with ntdsutil for NTDS.dit extraction and PowerShell-based enumeration tools. Credentials from domain controllers enable rapid lateral movement across the environment using legitimate administrator accounts.
T1021.001	Remote Services: RDP	RDP used throughout the lateral movement phase alongside AnyDesk and PuTTY for interactive access. SystemBC — the C2 tool carried over from Vice Society operations — provides persistent encrypted communication channels. Rhysida uses RDP to blend with legitimate admin activity during extended dwell periods averaging approximately 30 days before encryption.
T1070.001	Indicator Removal: Clear Windows Event Logs	wevtutil.exe used to clear System, Application, and Security event log categories post-access. Combined with Windows Defender exclusion additions for executable files and registry modifications — a documented evasion script pattern used by Rhysida affiliates to suppress security telemetry before and during encryption.
T1530	Data from Cloud Storage	A 2025 evolution documented in the updated CISA advisory: AZCopy (Azure CLI utility for blob storage transfers) and StorageExplorer-windows-x64.exe used to exfiltrate data to and from Azure storage accounts. This represents a shift toward cloud-native exfiltration channels that blend with legitimate enterprise cloud operations.
T1486	Data Encrypted for Impact	4096-bit RSA key pair generation per victim; ChaCha20 stream cipher for file encryption (via LibTomCrypt). Files appended with .rhysida extension. A cryptographic implementation vulnerability in early versions (ChaCha20-based CSPRNG seeded with system time via C rand()) enabled decryption without the key — discovered by multiple independent parties and publicly released as a free decryption tool by KISA in February 2024. Updated builds address this flaw.
T1657	Financial Theft — Extortion	Ransom note "CriticalBreachDetected.pdf" dropped as PDF in encrypted directories — PDF format noted by CISA as suggesting Rhysida targets systems compatible with PDF rendering. Victims provided a unique code and Tor .onion portal URL. Demands made in Bitcoin. Unique extortion model: stolen data listed on the Rhysida dark web site as an exclusive auction — "We sell only to one hand, no reselling" — with a deadline before public release if no buyer is found.

Known Campaigns

Selected confirmed and high-profile attributed incidents. Rhysida typically operates with extended dwell periods — averaging approximately 30 days between initial access and encryption — giving well-monitored environments a detection window before the final payload stage.

Tools & Malware

• Rhysida ransomware encryptor: 64-bit PE Windows application compiled with MINGW/GCC. Uses a 4096-bit RSA key pair generated per victim for key encapsulation; ChaCha20 stream cipher (via LibTomCrypt) for file encryption. Appends .rhysida extension to encrypted files. Drops "CriticalBreachDetected.pdf" ransom note in PDF format. Self-deletes after encryption to hinder forensic analysis. Compatible with pre-Windows 10 versions, expanding the potential victim base. Early builds contained a CSPRNG vulnerability enabling decryption without the key (patched following public disclosure in February 2024). Notably, early Rhysida samples — flagged by the HHS HC3 sector alert in August 2023 — lacked commodity ransomware features including VSS shadow copy deletion, multiple persistence mechanisms, and process termination unhooking. This absence of VSS deletion in early versions creates a potential recovery path for organisations compromised before the payload matured. Whether later builds added VSS deletion is not consistently confirmed across sources — forensic review is recommended before assuming VSS copies are unavailable.
• SystemBC: Proxy/C2 tool carried over from Vice Society operations. Used for persistent encrypted C2 communication. Sophos documents SystemBC PowerShell scripts named svchost.ps1 establishing persistence via HKCU run keys — the same pattern observed in TAC5279's Vice Society-era operations, providing direct attribution evidence.
• Cobalt Strike: Industry-standard penetration testing framework used post-access for C2, lateral movement staging, and payload delivery. Used alongside SystemBC in documented Rhysida campaigns.
• CleanUpLoader: Custom loader used in some Rhysida campaigns for payload delivery and post-exploitation staging.
• Gootloader (2025 addition): Malware-as-a-service delivery framework distributed through SEO poisoning — malicious websites ranking for software download search terms delivering trojanized installers. Added to Rhysida's initial access toolkit as documented in the April 2025 CISA advisory update.
• AZCopy / StorageExplorer (2025): Microsoft Azure command-line and GUI tools abused for cloud-native data exfiltration to attacker-controlled Azure storage accounts. Documented in the April 2025 CISA advisory update as new exfiltration methods observed in Rhysida operations through December 2024.
• AnyDesk / PuTTY / RDP: Legitimate remote access tools used for persistent access, lateral movement, and interactive operator presence throughout dwell periods. Inherited from Vice Society operational tradecraft.
• Secretsdump / ntdsutil: Credential harvesting tools for LSASS memory dumping and NTDS.dit extraction from domain controllers, providing domain-wide credential access to enable unrestricted lateral movement.
• wevtutil.exe: Native Windows event log management utility used to clear System, Application, and Security event logs post-access, removing forensic evidence of the intrusion before encryption begins.

Indicators of Compromise

IOCs sourced from CISA advisory AA23-319A (updated April 30, 2025). The updated advisory includes current email accounts, URLs, file paths, and network indicators from investigations through December 2024. The original November 2023 IOCs were partially removed in the April 2025 update as they were assessed outdated — use only the current advisory version.

Mitigation & Defense

Rhysida's primary initial access paths are VPN credential compromise and phishing. The 30-day average dwell period before encryption creates a genuine detection window for organizations with active monitoring — unlike faster-moving operators who encrypt within hours of access.

• Enforce MFA on all VPN access: VPN credential exploitation — either via phishing-harvested credentials or CVE exploitation — is Rhysida's primary initial access vector. Phishing-resistant MFA (FIDO2/passkeys) on all VPN portals closes this path. TOTP-based MFA provides partial protection but remains vulnerable to real-time phishing. Any VPN portal without MFA in Rhysida's target sectors should be treated as an active risk requiring immediate remediation.
• Deploy SEO poisoning awareness and software download controls: The 2025 addition of Gootloader to Rhysida's access toolkit means employees searching for legitimate software downloads may receive trojanized installers from malicious sites ranking in search results. Enforce approved software distribution through IT-managed channels and blocklist direct .exe downloads from unrecognized domains. User awareness training should include explicit coverage of software download risk.
• Monitor for staging directory creation: Rhysida actors consistently create C:\in and C:\out directories on compromised systems for tool staging. Alert on the creation of these specific directories on any domain-joined system outside of approved change management. Broader alerts on new directory creation at the C:\ root level from non-administrative processes catch this class of behavior.
• Hunt for SystemBC and svchost.ps1: The SystemBC PowerShell persistence script named svchost.ps1 establishing a HKCU run key is a documented TAC5279 tradecraft signature carried over from Vice Society. SIEM rules hunting for PowerShell scripts named svchost.ps1 in user context — or any new HKCU run key entry — can identify Rhysida presence during the dwell period, before encryption is triggered.
• Alert on wevtutil event log clearing: wevtutil.exe invocations clearing System, Application, or Security logs are a documented Rhysida pre-encryption behavior. These should trigger immediate tier-1 escalation regardless of the security context. Legitimate administrative use of wevtutil for log clearing outside approved maintenance windows is rare.
• Monitor AZCopy and StorageExplorer executions: The 2025 CISA advisory documents Rhysida's use of AZCopy and StorageExplorer for cloud-native exfiltration. Alert on execution of these tools on systems where they are not part of approved cloud management workflows, particularly when combined with large outbound network transfers to Azure blob storage endpoints.
• Patch ZeroLogon and VPN appliance CVEs: CVE-2020-1472 (ZeroLogon) is a documented Rhysida initial access vector. Any domain controller still vulnerable to ZeroLogon represents a critical unmitigated risk. VPN appliance CVEs should be patched on a sub-72-hour timeline for critical vulnerabilities given their consistent use as ransomware entry points across Rhysida and peer groups.
• Use the 30-day dwell window: Unlike groups that encrypt within hours of access, Rhysida's documented average dwell period of approximately 30 days between initial access and encryption provides a genuine detection opportunity. Organizations with 24/7 EDR monitoring and behavioral alerting — particularly for credential harvesting, lateral movement via RDP, and event log clearing — have a realistic chance of detecting and evicting Rhysida before the encryption phase begins. This window does not exist for faster-moving operators; it is a Rhysida-specific defensive advantage worth explicitly incorporating into incident response planning.

Sources & Further Reading

• CISA / FBI / HHS / MS-ISAC — #StopRansomware: Interlock Ransomware, Advisory AA25-203A (July 2025) — explicitly cross-references Rhysida code and technique similarities
• Ransom-DB — Rhysida Ransomware Group Profile: 2026 Analysis (January 2026)
• Industrial Cyber — Rhysida Claims Maryland Transit Administration Breach (September 2025) — includes demand history and Comparitech data
• CISA / FBI / MS-ISAC — #StopRansomware: Rhysida Ransomware, Advisory AA23-319A (November 2023; updated April 30, 2025)
• Sophos X-Ops — Same Threats, Different Ransomware: Vice Society and Rhysida TAC5279 Cluster Analysis (November 2023)
• SC World — Rhysida Ransomware Decryptor Publicly Released (February 2024)
• Barracuda Networks — Rhysida Ransomware: The Creepy Crawling Criminal Hiding in the Dark (May 2024)
• Huntress Threat Library — Rhysida Threat Actor Profile (2025)
• eSentire — Rhysida Ransomware Group Targets Hospitals, Power Plants, and Schools (2024)
• HIPAA Journal — Rhysida Healthcare Sector Coverage (ongoing)
• HHS HC3 — Rhysida Ransomware Sector Alert (2023)