Ransomware.live: rhysida

| Active

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.

The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.

The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.

After encryption, the ransomware appends the extension '.ryshida' to encrypted files.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

269

First Discovered

2023-06-05

victim

Last Discovered

2026-04-27

victim

Inactive Since

days

Avg Delay

37.6

days

Infostealer

38.2%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months

Known Locations (2)

Favicon	Title	Type	Available	Last Visit	Server Info	FQDN
			Yes	2026-05-13T22:45:28	nginx	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
	Rhysida		No	2026-05-13T22:45:34		`rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion`

Target

Heatmap

Ransom Notes (1)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
PowerView placeholder placeholder placeholder	AnyDesk placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	Impacket placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	NTDS Utility (ntdsutil) PsExec WMIC Windows Event Utility (wevtutil)	WinSCP placeholder placeholder placeholder

TTPs Matrix (12)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Discovery	Collection	Exfiltration	Command and Control	Impact	Resource Development	Reconnaissance
Abusing Elevation Control Mechanism: Bypass User Account Control	Command and Scripting Interpreter	Registry Run Keys / Startup Folder	Process Injection	Obfuscated Files or Information	Application Window Discovery	Data from Local System	Exfiltration Over C2 Channel	Application Layer Protocol	Data Encrypted for Impact	Acquire Infrastructure	Active Scanning
Phishing	Shared Modules		Thread Execution Hijacking	Masquerading	Process Discovery	Automated Collection		Web Protocols		Develop Capabilities	Phishing for Information
			Registry Run Keys	Process Injection	System Information Discovery
				Thread Execution Hijacking	File and Directory Discovery
				Virtualization/Sandbox Evasion	Virtualization/Sandbox Evasion
				Hidden Artifacts	Security Software Discovery
				NTFS File Attributes
				Reflective DLL Injection

YARA Rules (1)

Indicators of Compromise (IoCs) (28)

Hash MD5 28

Type	IOC
`Hash MD5`	`0c8e88877383ccd23a755f429006b437`
`Hash MD5`	`0cf5491278c7d87e8c3fc88c7f9f26ff`
`Hash MD5`	`17a22e1b633068dc45df51679df233cc`
`Hash MD5`	`1888ecf4e90f02ecaaefdb3624825fa2`
`Hash MD5`	`1e256229b58061860be8dbf0dc4fe67e`
`Hash MD5`	`26f41a46d0addde100bb9512a130de5e`
`Hash MD5`	`2b825ea77e240d2ab6b6695a602cb07c`
`Hash MD5`	`3225b95fc72f238ab1e53bfabc11b551`
`Hash MD5`	`44c7d18633b5741db270a6bd378b6f3c`
`Hash MD5`	`4ef0160b3eb114a94aeedd0bb5716058`
`Hash MD5`	`54416fc42afa9b09ea7e8d8e318f4891`
`Hash MD5`	`569d2b5701755260514fe1563d7530bb`
`Hash MD5`	`59a9ca795b59161f767b94fc2dece71a`
`Hash MD5`	`5f3ecd02a94cec2b62bfecd79f5a1d98`
`Hash MD5`	`6742fdde9d5fde37ac5a9c9cbb1f691f`
`Hash MD5`	`67edfff8250487d97f403c74fed85388`
`Hash MD5`	`6dd8c26f64df37d0c7645b63c9bba51f`
`Hash MD5`	`7cfba113342f78b5909f606c26fc1dc4`
`Hash MD5`	`7dd4de113a97c638518f01760ff4f03c`
`Hash MD5`	`93be893ff74816c49f2706f222789027`
`Hash MD5`	`bea5c2c91e1fa97854c65ece18456b0e`
`Hash MD5`	`c43f12b8330643c72d21bad3b6cfcf82`
`Hash MD5`	`c9a5e675dbb1f0ce61623f24757a1c72`
`Hash MD5`	`d86383882515b7a9218d5f69924feadf`
`Hash MD5`	`ddaa09b5c3bf5aa24e300c24905469f2`
`Hash MD5`	`f6e5f0ed974c89e2b4a47989fc987c79`
`Hash MD5`	`fac561bb0f072d29fe6f8ee6072c905a`
`Hash MD5`	`fbbb2685cb612b25c50c59c1ffa6e654`