Rhysida
Attribution profile
- Type
- Crime Syndicate
- Location
- France
- Known incidents
- 14 incidents
- Sources
- 16 sources
- First seen
- 2023-05-16
- Last seen
- 2026-08-07
- Updated
- 2026-10-13 04:51
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Rhysida, also known as the Rhysida ransomware group, is a ransomware‑as‑a‑service operation that has claimed attacks on government, healthcare, education and private‑sector targets in Germany, the United States, Peru, the United Kingdom and other regions. The group’s observed objectives are financial extortion—demanding bitcoin ransoms and threatening to auction or publish stolen data—and causing disruption through encryption and destruction of victim systems. Reported tactics include gaining initial access via valid accounts on external‑facing remote services lacking multi‑factor authentication, exploiting Zerologon (CVE‑2020‑1472), and using phishing; compromising Terminal Services servers that lack MFA; employing defense‑evasion and anti‑forensic techniques to hide activity; exfiltrating data before encryption; and encrypting or destroying servers to impede recovery. Public analyses note an overlap with the Vice Society cluster (tracked as Storm‑0832) per Check Point and referenced in a CISA/FBI advisory, but no state sponsorship has been publicly established. Representative operations cited in open sources are the August 2026 breach of Berlin’s state network (≈5.79 TB exfiltrated, 30 bitcoin ransom demand), the July 2025 ransomware attack on Cookeville Regional Medical Center affecting over 337 000 individuals, the October 2023 British Library incident (≈600 GB exfiltrated, systems encrypted and destroyed), and the February 2025 attacks on a UK‑based book printer and a London literary agency.
Incidents
Attributed incidents are available to members.
14 incidentsSources
Sources available to members: 16 sources.