Rhysida

| Active

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.

The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.

The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.

After encryption, the ransomware appends the extension '.ryshida' to encrypted files.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

268

First Discovered

2023-06-05

victim

Last Discovered

2026-03-02

victim

Inactive Since

days

Avg Delay

37.6

days

Infostealer

12.7%

victims with domain

View Victims on World Map

View group statistics

Known Locations (4)

Title	Available	Last Visit	Server Info	FQDN
Rhysida	Yes	2026-04-01 20:02:56	nginx	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
	No	2026-04-01 21:02:33	nginx	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
	No	2026-04-01 21:05:05	nginx	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
Rhysida	Yes	2026-04-01 21:07:21	nginx	`rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (1)

Tools Used (Available)

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
PowerView placeholder placeholder placeholder	AnyDesk placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	Impacket placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	NTDS Utility (ntdsutil) PsExec Windows Event Utility (wevtutil) WMIC	WinSCP placeholder placeholder placeholder

Vulnerabilities Exploited (0)

TTPs Matrix (12)

This information is provided by Crocodyli & Ransomware.live
Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Discovery	Collection	Command and Control	Exfiltration	Impact
Active Scanning	Acquire Infrastructure	Phishing	Command and Scripting Interpreter	Registry Run Keys / Startup Folder	Process Injection	Obfuscated Files or Information	Application Window Discovery	Data from Local System	Application Layer Protocol	Exfiltration Over C2 Channel	Data Encrypted for Impact
Phishing for Information	Develop Capabilities	Abusing Elevation Control Mechanism: Bypass User Account Control	Shared Modules		Thread Execution Hijacking	Masquerading	Process Discovery	Automated Collection	Web Protocols
					Registry Run Keys	Process Injection	System Information Discovery
						Thread Execution Hijacking	File and Directory Discovery
						Virtualization/Sandbox Evasion	Virtualization/Sandbox Evasion
						Hidden Artifacts	Security Software Discovery
						NTFS File Attributes
						Reflective DLL Injection

Negotiation Chats (0)

YARA Rules (1)

Indicators of Compromise (IoCs) (28)

MD5 28

Type	IOC
`md5`	`f6e5f0ed974c89e2b4a47989fc987c79`
`md5`	`6742fdde9d5fde37ac5a9c9cbb1f691f`
`md5`	`7cfba113342f78b5909f606c26fc1dc4`
`md5`	`6dd8c26f64df37d0c7645b63c9bba51f`
`md5`	`0cf5491278c7d87e8c3fc88c7f9f26ff`
`md5`	`d86383882515b7a9218d5f69924feadf`
`md5`	`3225b95fc72f238ab1e53bfabc11b551`
`md5`	`ddaa09b5c3bf5aa24e300c24905469f2`
`md5`	`5f3ecd02a94cec2b62bfecd79f5a1d98`
`md5`	`1888ecf4e90f02ecaaefdb3624825fa2`
`md5`	`c43f12b8330643c72d21bad3b6cfcf82`
`md5`	`bea5c2c91e1fa97854c65ece18456b0e`
`md5`	`93be893ff74816c49f2706f222789027`
`md5`	`569d2b5701755260514fe1563d7530bb`
`md5`	`0c8e88877383ccd23a755f429006b437`
`md5`	`2b825ea77e240d2ab6b6695a602cb07c`
`md5`	`7dd4de113a97c638518f01760ff4f03c`
`md5`	`59a9ca795b59161f767b94fc2dece71a`
`md5`	`fbbb2685cb612b25c50c59c1ffa6e654`
`md5`	`c9a5e675dbb1f0ce61623f24757a1c72`
`md5`	`67edfff8250487d97f403c74fed85388`
`md5`	`1e256229b58061860be8dbf0dc4fe67e`
`md5`	`44c7d18633b5741db270a6bd378b6f3c`
`md5`	`17a22e1b633068dc45df51679df233cc`
`md5`	`26f41a46d0addde100bb9512a130de5e`
`md5`	`4ef0160b3eb114a94aeedd0bb5716058`
`md5`	`54416fc42afa9b09ea7e8d8e318f4891`
`md5`	`fac561bb0f072d29fe6f8ee6072c905a`