Ransomware.live: Rhysida

| Active

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.

The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.

The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.

After encryption, the ransomware appends the extension '.ryshida' to encrypted files.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Extension(s): .rhysida

Victims

308

First Victim

2023-06-05

(est. attack date)

Discovery Date

2023-06-05

Last Seen

2026-10-29

Inactive Since

day

Avg Delay

37.6

days

Infostealer

49.6%

victims with domain

Countries

hit

Uptime

86.4% avg (30d)

View Victims on World Map View Group Statistics MITRE ATT&CK Navigator

Attack Velocity — Last 12 months (based on attack estimated date if available)

+33% vs last month

Known Locations (7)

Title	Available	Last Visit	Server Info	FQDN
	Yes	2026-10-30T04:16:38	nginx	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
Rhysida	Yes	2026-10-30T04:17:15	nginx	`rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion`
Onionsite Not Found	Yes	2026-10-30T04:17:53	nginx	`rhysidaxx6gdihss7urv4ecbh2yz4izhnfulfbrb4ua5dwkocm653yid.onion`
	No	2026-10-30T04:18:02		`rhysidaeoxtkejwuheks3a7htk4zn3dfuynt5mqw6oawlcx6kcxjdeyd.onion`
	No	2026-10-30T04:19:11		`rhysida6qqkj5ahjfshlepbhk7m2sgqc25y5iznmabcch2i7pbw4g6yd.onion`
Onionsite Not Found	Yes	2026-10-30T04:20:51	nginx	`rhysidaqho36b6i6mvpmy5di4ro5zglovtxixrirky6q3fgack7q5uyd.onion`
	No	2026-10-30T04:20:57		`rhysidaiqemmlrvn2jvncdwhkvuiv7s2iu342xnrpeynxoe6r2dtjfyd.onion`

Target

Heatmap

Ransom Notes (1)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
PowerView placeholder placeholder placeholder	AnyDesk placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	Impacket placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	NTDS Utility (ntdsutil) PsExec WMIC Windows Event Utility (wevtutil)	WinSCP placeholder placeholder placeholder

Vulnerabilities Exploited (5)

This information is provided by Ransomware-Vulnerability-Matrix & Ransomware.live
Vendor	Product	CVE	Source
Check Point	Security Gateway	CVE-2026-50751	—
Nx	Nx Console	CVE-2026-48027	—
Microsoft	Exchange Server	CVE-2023-21529	—
ConnectWise	ScreenConnect	CVE-2024-1708	—
Microsoft	Windows	CVE-2025-60710	—

TTPs Matrix (12)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Discovery	Collection	Exfiltration	Command and Control	Impact	Resource Development	Reconnaissance
Abusing Elevation Control Mechanism: Bypass User Account Control	Command and Scripting Interpreter	Registry Run Keys / Startup Folder	Process Injection	Obfuscated Files or Information	Application Window Discovery	Data from Local System	Exfiltration Over C2 Channel	Application Layer Protocol	Data Encrypted for Impact	Acquire Infrastructure	Active Scanning
Phishing	Shared Modules		Thread Execution Hijacking	Masquerading	Process Discovery	Automated Collection		Web Protocols		Develop Capabilities	Phishing for Information
			Registry Run Keys	Process Injection	System Information Discovery
				Thread Execution Hijacking	File and Directory Discovery
				Virtualization/Sandbox Evasion	Virtualization/Sandbox Evasion
				Hidden Artifacts	Security Software Discovery
				NTFS File Attributes
				Reflective DLL Injection

KQL Query (3)

YARA Rules (1)

Indicators of Compromise (IoCs) (28)

Hash MD5 28

Type	IOC
`Hash MD5`	`0c8e88877383ccd23a755f429006b437`
`Hash MD5`	`0cf5491278c7d87e8c3fc88c7f9f26ff`
`Hash MD5`	`17a22e1b633068dc45df51679df233cc`
`Hash MD5`	`1888ecf4e90f02ecaaefdb3624825fa2`
`Hash MD5`	`1e256229b58061860be8dbf0dc4fe67e`
`Hash MD5`	`26f41a46d0addde100bb9512a130de5e`
`Hash MD5`	`2b825ea77e240d2ab6b6695a602cb07c`
`Hash MD5`	`3225b95fc72f238ab1e53bfabc11b551`
`Hash MD5`	`44c7d18633b5741db270a6bd378b6f3c`
`Hash MD5`	`4ef0160b3eb114a94aeedd0bb5716058`
`Hash MD5`	`54416fc42afa9b09ea7e8d8e318f4891`
`Hash MD5`	`569d2b5701755260514fe1563d7530bb`
`Hash MD5`	`59a9ca795b59161f767b94fc2dece71a`
`Hash MD5`	`5f3ecd02a94cec2b62bfecd79f5a1d98`
`Hash MD5`	`6742fdde9d5fde37ac5a9c9cbb1f691f`
`Hash MD5`	`67edfff8250487d97f403c74fed85388`
`Hash MD5`	`6dd8c26f64df37d0c7645b63c9bba51f`
`Hash MD5`	`7cfba113342f78b5909f606c26fc1dc4`
`Hash MD5`	`7dd4de113a97c638518f01760ff4f03c`
`Hash MD5`	`93be893ff74816c49f2706f222789027`
`Hash MD5`	`bea5c2c91e1fa97854c65ece18456b0e`
`Hash MD5`	`c43f12b8330643c72d21bad3b6cfcf82`
`Hash MD5`	`c9a5e675dbb1f0ce61623f24757a1c72`
`Hash MD5`	`d86383882515b7a9218d5f69924feadf`
`Hash MD5`	`ddaa09b5c3bf5aa24e300c24905469f2`
`Hash MD5`	`f6e5f0ed974c89e2b4a47989fc987c79`
`Hash MD5`	`fac561bb0f072d29fe6f8ee6072c905a`
`Hash MD5`	`fbbb2685cb612b25c50c59c1ffa6e654`

Victims (308)

INTAX, Inc.