rhysida
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.<br> <br> The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.<br> <br> The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.<br> <br> After encryption, the ransomware appends the extension '.ryshida' to encrypted files.<BR>Source: https://github.com/crocodyli/ThreatActors-TTPs
Threat Level
HIGH
Tactics, Techniques & Procedures (TTPs)
DiscoveryEnum
- PowerView
Exfiltration
- WinSCP
LOLBAS
- NTDS Utility (ntdsutil)
- PsExec
- WMIC
- Windows Event Utility (wevtutil)
Offsec
- Impacket
RMM-Tools
- AnyDesk
Check If You’re Affected
Search our database to see if your organization appears in rhysida’s victim list.
risk score · threat categories · sources · age · confidence — in one request