Rhysida

| Active

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.

The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.

The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.

After encryption, the ransomware appends the extension '.ryshida' to encrypted files.
Source: https://github.com/crocodyli/ThreatActors-TTPs

External information

Victims

236

First Discovered

victim

2023-06-05

Last Discovered

victim

2025-11-04

Inactive Since

in days

0

Avg Delay

between attack and claim

37.6 days

Infostealer

for victim with domain

12.7%

View Victims on World Map

View group statistics

Known Locations (4)

Title	Available	Last Visit	Server Info	FQDN
Rhysida	Yes	2025-11-04 12:31:29	nginx	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
	Yes	2025-11-04 12:32:58	nginx	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
	Yes	2025-11-04 12:34:03	nginx	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
Rhysida	No	2025-11-04 13:00:24		`rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (1)

Tools Used (Available)

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
PowerView placeholder placeholder placeholder	AnyDesk placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	Impacket placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	NTDS Utility (ntdsutil) PsExec Windows Event Utility (wevtutil) WMIC	WinSCP placeholder placeholder placeholder

Vulnerabilities Exploited (0)

TTPs Matrix (0)

Negotiation Chats (0)

YARA Rules (1)

Indicators of Compromise (IoCs) (28)

MD5 28

Type	IOC
`md5`	`f6e5f0ed974c89e2b4a47989fc987c79`
`md5`	`6742fdde9d5fde37ac5a9c9cbb1f691f`
`md5`	`7cfba113342f78b5909f606c26fc1dc4`
`md5`	`6dd8c26f64df37d0c7645b63c9bba51f`
`md5`	`0cf5491278c7d87e8c3fc88c7f9f26ff`
`md5`	`d86383882515b7a9218d5f69924feadf`
`md5`	`3225b95fc72f238ab1e53bfabc11b551`
`md5`	`ddaa09b5c3bf5aa24e300c24905469f2`
`md5`	`5f3ecd02a94cec2b62bfecd79f5a1d98`
`md5`	`1888ecf4e90f02ecaaefdb3624825fa2`
`md5`	`c43f12b8330643c72d21bad3b6cfcf82`
`md5`	`bea5c2c91e1fa97854c65ece18456b0e`
`md5`	`93be893ff74816c49f2706f222789027`
`md5`	`569d2b5701755260514fe1563d7530bb`
`md5`	`0c8e88877383ccd23a755f429006b437`
`md5`	`2b825ea77e240d2ab6b6695a602cb07c`
`md5`	`7dd4de113a97c638518f01760ff4f03c`
`md5`	`59a9ca795b59161f767b94fc2dece71a`
`md5`	`fbbb2685cb612b25c50c59c1ffa6e654`
`md5`	`c9a5e675dbb1f0ce61623f24757a1c72`
`md5`	`67edfff8250487d97f403c74fed85388`
`md5`	`1e256229b58061860be8dbf0dc4fe67e`
`md5`	`44c7d18633b5741db270a6bd378b6f3c`
`md5`	`17a22e1b633068dc45df51679df233cc`
`md5`	`26f41a46d0addde100bb9512a130de5e`
`md5`	`4ef0160b3eb114a94aeedd0bb5716058`
`md5`	`54416fc42afa9b09ea7e8d8e318f4891`
`md5`	`fac561bb0f072d29fe6f8ee6072c905a`

Victims (236)

Invacare Rhysida

Discovery Date: 2025-11-04

Invacare Invacare, founded in 1885 and headquartered out of Elyria, Ohio, is a manufacturer and dist...

Spindletop Center Rhysida

Discovery Date: 2025-10-30

Spindletop Center Spindletop Center is a non-profit healthcare organization focused on providing beh...

Gemini Group Rhysida

Discovery Date: 2025-10-28

Gemini Group...

Bellflower Unified School District Rhysida

Discovery Date: 2025-10-28

Bellflower Unified School District Headquartered Bellflower, California, Bellflower Unified School D...

Abilene Family Medical Associates Rhysida

Discovery Date: 2025-10-27

Abilene Family Medical Associates...

Peraso Rhysida

Discovery Date: 2025-10-21

Peraso...

Hematology Oncology Consultants Rhysida

Discovery Date: 2025-10-17

Hematology Oncology Consultants Michigan Hematology Oncology is a private practice dedicated to prov...

GEIGER Rhysida

Discovery Date: 2025-10-17

GEIGER GEIGER Antriebstechnik is a leading manufacturer of innovative mechanical and electric drive ...

Sibbalds Rhysida

Discovery Date: 2025-10-16

Sibbalds Sibbalds Chartered Accountants, based in Derby, specializes in providing a wide range of ac...

Tex-Tube Rhysida

Discovery Date: 2025-10-15

Tex-Tube Tex Tube has over 75 years of experience in manufacturing steel products, specifically elec...

Furuno Electric Rhysida

Discovery Date: 2025-10-13

Furuno Electric FURUNO strives to contribute to realisation of the pleasant society filled with safe...

Sdii Global Rhysida

Discovery Date: 2025-10-09

Sdii Global Since 1989, Sdii Global has set the standard in forensic engineering and consulting, ren...

JASCO Applied Sciences Rhysida

Discovery Date: 2025-10-07

JASCO Applied Sciences...

Medstar Health Rhysida

Discovery Date: 2025-10-04

Medstar Health...

Peavey Electronics Corporation Rhysida

Discovery Date: 2025-09-29

Peavey Electronics Corporation Founded by Hartley Peavey in 1965 as a one-man shop, today Peavey Ele...

The Maryland Department of Transportation Rhysida

Discovery Date: 2025-09-24

The Maryland Department of Transportation...

Coastal Pacific Xpress Rhysida

Discovery Date: 2025-09-10

Coastal Pacific Xpress...

Elite Trailers Rhysida

Discovery Date: 2025-09-05

Elite Trailers Elite Trailer MFG, LLC. specializes in the custom manufacturing of high-quality trail...

Firelands Scientific Rhysida

Discovery Date: 2025-08-28

Firelands Scientific...

ZCORP Rhysida

Discovery Date: 2025-08-27

ZCORP ZCORP is a technology enterprise based in Princeton, NJ, specializing in providing innovative ...

Elkhart Independent School District Rhysida

Discovery Date: 2025-08-20

Elkhart Independent School District Elkhart Independent School District is a public school district ...

Trans-Tex Rhysida

Discovery Date: 2025-08-12

Trans-Tex Trans-Tex has been the leader in narrow web dye sublimation printing for over 25 years....

Alascom Rhysida

Discovery Date: 2025-08-10

Alascom It has been operating for over 20 years as a system integrator and supplier of technical con...

Cookeville Regional Medical Center Rhysida

Discovery Date: 2025-08-02

Cookeville Regional Medical Center At Cookeville Regional Medical Center, we are dedicated to provid...

First Baptist Church of Hammond Rhysida

Discovery Date: 2025-07-29

First Baptist Church of Hammond Established in 1887, The First Baptist Church was listed as 2009's 1...

Cardinal Services Rhysida

Discovery Date: 2025-07-15

Cardinal Services Cardinal Services was established by Bud and Gail Freeman in Coos Bay, Oregon in 1...

Florida Hand Center Rhysida

Discovery Date: 2025-07-08

Florida Hand Center Florida Hand Center specializes in non-surgical and minimally invasive treatment...

Welthungerhilfe Rhysida

Discovery Date: 2025-06-29

Welthungerhilfe Welthungerhilfe (WHH) is one of the largest private aid agencies in Germany; politic...

Coreix Rhysida

Discovery Date: 2025-06-18

Coreix Coreix Cloud Services Limited provides a wide range of cloud computing solutions including pu...

CNPC USA Rhysida

Discovery Date: 2025-06-16

CNPC USA CNPC USA Corporation is a Houston-based company that was founded in 2011 to help connect No...

Hudson River Housing Rhysida

Discovery Date: 2025-06-07

Hudson River Housing Hudson River Housing provides quality, affordable rental housing for individual...

Cator Ruma & Associates Rhysida

Discovery Date: 2025-05-28

Cator Ruma & Associates Since our founding in 1959, Cator, Ruma & Associates has worked with many ar...

Carrera Chevrolet Rhysida

Discovery Date: 2025-05-26

Carrera Chevrolet...

Florida Lung Rhysida

Discovery Date: 2025-05-20

Florida Lung The Mission of Florida Lung, Asthma & Sleep Specialists is to be a leader in the provis...

Termolar Rhysida

Discovery Date: 2025-05-18

Termolar Termolar is the largest manufacturer of thermal conservation products in Latin America....

Sao Camilo Cachoeiro de Itapemirim Rhysida

Discovery Date: 2025-05-14

Sao Camilo Cachoeiro de Itapemirim The Sao Camilo Espirito Santo Educational Center was founded in 1...

Mountain View Mushrooms Rhysida

Discovery Date: 2025-05-09

Mountain View Mushrooms Mountain View Mushrooms was established in 2003. We are the largest producer...

Mediprobe Research Rhysida

Discovery Date: 2025-05-05

Mediprobe Research Mediprobe Research Inc. is a world class dermatology research and clinical trials...

Kalin Hobeltechnik Rhysida

Discovery Date: 2025-05-03

Kalin Hobeltechnik Kalin operates throughout Europe and has established a solid reputation with plan...

Government of Peru Rhysida

Discovery Date: 2025-05-01

Government of Peru Gob.pe is defined as the Single Digital Platform of the Peruvian State....

Coop UQAM Rhysida

Discovery Date: 2025-04-29

Coop UQAM COOP UQAM is one of the largest school-based cooperatives in Quebec. Located in the heart ...

LaBella Associates Rhysida

Discovery Date: 2025-04-28

LaBella Associates Founded in 1978, LaBella Associates is a full service Architecture, Engineering, ...

MDB Rhysida

Discovery Date: 2025-04-26

MDB MDB Srl was founded in 1977 by Mario Di Biase in Abruzzo, Italy....

Milicic Rhysida

Discovery Date: 2025-04-23

Milicic We are an Argentine construction and services company with 50 years of experience in large-s...

Acos Favorit Rhysida

Discovery Date: 2025-04-22

Acos Favorit Founded in 1996 by Rudolf Fritsch, Acos Favorit Distribuidora Ltda focuses on cutting a...

Oregon Department of Environmental Quality Rhysida

Discovery Date: 2025-04-15

Oregon Department of Environmental Quality They think their data hasn't been stolen. They're sorely ...

Dimension Composite Rhysida

Discovery Date: 2025-04-12

Dimension Composite Dimension Composite is an ISO 9001:2000 certified company, whose mission is to d...

Swiss Capitals Group Rhysida

Discovery Date: 2025-04-06

Swiss Capitals Group Swiss Capitals Group is the holding of a group of companies with more than 40 y...

Clarity Ventures Rhysida

Discovery Date: 2025-04-02

Clarity Ventures Clarity Ventures, Inc offers custom eCommerce and mobile web design solutions as we...

Forrest City School District Rhysida

Discovery Date: 2025-03-28

Forrest City School District Forrest City School District 7 is a school district headquartered in Fo...

Senior Support Services Rhysida

Discovery Date: 2025-03-27

Senior Support Services Senior Support Services (CPHC) first began serving the seniors of Brockvill...

Okeene Elementary School Rhysida

Discovery Date: 2025-03-25

Okeene Elementary School Okeene Elementary School is a public school located in Okeene, OK, which is...

Ted Hosmer Enterprises Rhysida

Discovery Date: 2025-03-18

Ted Hosmer Enterprises Ted Hosmer Enterprises, established in 1987, specializes in lawn care and sno...

Cothron's Security Professionals Rhysida

Discovery Date: 2025-03-14

Cothron's Security Professionals Founded by Mr. Olen Cothron in 1948, Cothron's is a leader in the s...

British virgin islands London Office Rhysida

Discovery Date: 2025-03-09

British virgin islands London Office Opened in 2002, the BVI London Office represents the interests ...

Best Collateral, Inc. Rhysida

Discovery Date: 2025-03-05

Best Collateral, Inc. Headquartered in San Rafael, California, Best Collateral opened its first stor...

Newton & Associates, Inc Rhysida

Discovery Date: 2025-03-01

Newton & Associates, Inc Newton & Associates Inc is a company that operates in the Accounting Servic...

Peter Glenn Ski Sport Rhysida

Discovery Date: 2025-02-22

Peter Glenn Ski Sport Peter Glenn Ski and Sport is a retailer of clothing and accessories for skiing...

Buanderie Centrale de Montreal Rhysida

Discovery Date: 2025-02-18

Buanderie Centrale de Montreal BCM is a non-profit organization that, since 1979 , has offered laund...

The Agency Rhysida

Discovery Date: 2025-02-14

The Agency Established in 1995, The Agency represents the most formidable list of writers, directors...

Leading Edge Specialized Dentistry Rhysida