rhysida

Last Updated Nov 9, 2026

Also known as: Rhysida, rhysida

The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it’s worth mentioning that Rhysida is still in the early stages of development.

The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.

After encryption, the ransomware appends the extension “.ryshida” to encrypted files.

For encryption purposes, Trend Micro published an analysis stating that the ransomware uses a 4096-bit RSA key and AES-CTR for encryption.

In addition to the encryption method, Trend Micro published an analysis of the Ryshida Ransomware attack chain.

Finally, the group has a website on the Tor network hosting the companies that have been breached.

📝 Last Updated Nov 9, 2026

Introduction

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets’ networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it’s worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin. After encryption, the ransomware appends the extension “.ryshida” to encrypted files. For encryption purposes, Trend Micro published an analysis stating that the ransomware uses a 4096-bit RSA key and AES-CTR for encryption. In addition to the encryption method, Trend Micro published an analysis of the Ryshida Ransomware attack chain. Finally, the group has a website on the Tor network hosting the companies that have been breached.

Activities and Tactics

Information pending cataloguing.

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Ransomware Vulnerability Matrix observations

Category	Vendor	Product	CVEs
Microsoft Products	Windows	NetLogon	CVE-2020-1472

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

Cobalt Strike:

Ransomware Tool Matrix observations

Category	Observed tools
Discovery	PowerView
Exfiltration	WinSCP
LOLBAS	NTDS Utility (ntdsutil), PsExec, WMIC, Windows Event Utility (wevtutil)
OffSec	Impacket
RMM Tools	AnyDesk

Attribution and Evidence

Information pending cataloguing.

References

References pending cataloguing.

Source Attribution

Structured source: MISP Galaxy

Data sourced from MISP Galaxy threat-actor cluster (CC0 licensed)

View upstream source record

Additional source provenance

misp galaxy Dataset
BushidoUK Ransomware Tool Matrix Tool observations were reviewed from the BushidoUK Ransomware Tool Matrix (https://github.com/BushidoUK/Ransomware-Tool-Matrix). The matrix is used here as a secondary ransomware tradecraft reference, not as sole attribution evidence. Repository Dataset
BushidoUK Ransomware Vulnerability Matrix Vulnerability observations were reviewed from the BushidoUK Ransomware Vulnerability Matrix (https://github.com/BushidoUK/Ransomware-Vulnerability-Matrix). The matrix is used here as a secondary ransomware exploitation reference, not as sole attribution evidence. Repository Dataset
Palo Alto Networks Unit 42 Threat Actor Groups Dataset

Source and license policy

🔍 Quick Filters

Top Countries

Risk Distribution

High

161

Critical

Medium

Low

Introduction

Activities and Tactics

Notable Campaigns

Tactics, Techniques, and Procedures (TTPs)

Ransomware Vulnerability Matrix observations

Notable Indicators of Compromise (IOCs)

Malware and Tools

Ransomware Tool Matrix observations

Attribution and Evidence

References

Recent News

Clickable IOC Blocks