Rhysida

| active

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.

The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.

The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.

After encryption, the ransomware appends the extension '.ryshida' to encrypted files.
Source: https://github.com/crocodyli/ThreatActors-TTPs

External information

Victims

215

First Discovered

victim

2023-06-05

Last Discovered

victim

2025-08-12

Inactive Since

in day(s)

8

Avg Delay

between attack and claim

37.6 days

Infostealer

for victim with domain

12.2%

View Victims on World Map

View group statistics

Known Locations (4)

Title	Available	Last Visit	Server Info	FQDN
Rhysida	Yes	2025-08-20 09:31:24	nginx	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
	Yes	2025-08-20 09:32:38	nginx	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
	Yes	2025-08-20 09:01:17	nginx	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
Rhysida	Yes	2025-08-20 09:33:42	nginx	`rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (1)

Tools Used (Available)

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
PowerView placeholder placeholder placeholder	AnyDesk placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	Impacket placeholder placeholder placeholder	placeholder placeholder placeholder placeholder	NTDS Utility (ntdsutil) PsExec Windows Event Utility (wevtutil) WMIC	WinSCP placeholder placeholder placeholder

Vulnerabilities Exploited (0)

TTPs Matrix (0)

Negotiation Chats (0)

YARA Rules (1)

Indicators of Compromise (IoCs) (28)

MD5 28

Type	IOC
`md5`	`f6e5f0ed974c89e2b4a47989fc987c79`
`md5`	`6742fdde9d5fde37ac5a9c9cbb1f691f`
`md5`	`7cfba113342f78b5909f606c26fc1dc4`
`md5`	`6dd8c26f64df37d0c7645b63c9bba51f`
`md5`	`0cf5491278c7d87e8c3fc88c7f9f26ff`
`md5`	`d86383882515b7a9218d5f69924feadf`
`md5`	`3225b95fc72f238ab1e53bfabc11b551`
`md5`	`ddaa09b5c3bf5aa24e300c24905469f2`
`md5`	`5f3ecd02a94cec2b62bfecd79f5a1d98`
`md5`	`1888ecf4e90f02ecaaefdb3624825fa2`
`md5`	`c43f12b8330643c72d21bad3b6cfcf82`
`md5`	`bea5c2c91e1fa97854c65ece18456b0e`
`md5`	`93be893ff74816c49f2706f222789027`
`md5`	`569d2b5701755260514fe1563d7530bb`
`md5`	`0c8e88877383ccd23a755f429006b437`
`md5`	`2b825ea77e240d2ab6b6695a602cb07c`
`md5`	`7dd4de113a97c638518f01760ff4f03c`
`md5`	`59a9ca795b59161f767b94fc2dece71a`
`md5`	`fbbb2685cb612b25c50c59c1ffa6e654`
`md5`	`c9a5e675dbb1f0ce61623f24757a1c72`
`md5`	`67edfff8250487d97f403c74fed85388`
`md5`	`1e256229b58061860be8dbf0dc4fe67e`
`md5`	`44c7d18633b5741db270a6bd378b6f3c`
`md5`	`17a22e1b633068dc45df51679df233cc`
`md5`	`26f41a46d0addde100bb9512a130de5e`
`md5`	`4ef0160b3eb114a94aeedd0bb5716058`
`md5`	`54416fc42afa9b09ea7e8d8e318f4891`
`md5`	`fac561bb0f072d29fe6f8ee6072c905a`

Victims (215)

Trans-Tex Rhysida

Discovery Date: 2025-08-12

Trans-Tex Trans-Tex has been the leader in narrow web dye sublimation printing for over 25 years....

Alascom Rhysida

Discovery Date: 2025-08-10

Alascom It has been operating for over 20 years as a system integrator and supplier of technical con...

Cookeville Regional Medical Center Rhysida

Discovery Date: 2025-08-02

Cookeville Regional Medical Center At Cookeville Regional Medical Center, we are dedicated to provid...

First Baptist Church of Hammond Rhysida

Discovery Date: 2025-07-29

First Baptist Church of Hammond Established in 1887, The First Baptist Church was listed as 2009's 1...

Cardinal Services Rhysida

Discovery Date: 2025-07-15

Cardinal Services Cardinal Services was established by Bud and Gail Freeman in Coos Bay, Oregon in 1...

Florida Hand Center Rhysida

Discovery Date: 2025-07-08

Florida Hand Center Florida Hand Center specializes in non-surgical and minimally invasive treatment...

Welthungerhilfe Rhysida

Discovery Date: 2025-06-29

Welthungerhilfe Welthungerhilfe (WHH) is one of the largest private aid agencies in Germany; politic...

Coreix Rhysida

Discovery Date: 2025-06-18

Coreix Coreix Cloud Services Limited provides a wide range of cloud computing solutions including pu...

CNPC USA Rhysida

Discovery Date: 2025-06-16

CNPC USA CNPC USA Corporation is a Houston-based company that was founded in 2011 to help connect No...

Hudson River Housing Rhysida

Discovery Date: 2025-06-07

Hudson River Housing Hudson River Housing provides quality, affordable rental housing for individual...

Cator Ruma & Associates Rhysida

Discovery Date: 2025-05-28

Cator Ruma & Associates Since our founding in 1959, Cator, Ruma & Associates has worked with many ar...

Carrera Chevrolet Rhysida

Discovery Date: 2025-05-26

Carrera Chevrolet...

Florida Lung Rhysida

Discovery Date: 2025-05-20

Florida Lung The Mission of Florida Lung, Asthma & Sleep Specialists is to be a leader in the provis...

Termolar Rhysida

Discovery Date: 2025-05-18

Termolar Termolar is the largest manufacturer of thermal conservation products in Latin America....

Sao Camilo Cachoeiro de Itapemirim Rhysida

Discovery Date: 2025-05-14

Sao Camilo Cachoeiro de Itapemirim The Sao Camilo Espirito Santo Educational Center was founded in 1...

Mountain View Mushrooms Rhysida

Discovery Date: 2025-05-09

Mountain View Mushrooms Mountain View Mushrooms was established in 2003. We are the largest producer...

Mediprobe Research Rhysida

Discovery Date: 2025-05-05

Mediprobe Research Mediprobe Research Inc. is a world class dermatology research and clinical trials...

Kalin Hobeltechnik Rhysida

Discovery Date: 2025-05-03

Kalin Hobeltechnik Kalin operates throughout Europe and has established a solid reputation with plan...

Government of Peru Rhysida

Discovery Date: 2025-05-01

Government of Peru Gob.pe is defined as the Single Digital Platform of the Peruvian State....

Coop UQAM Rhysida

Discovery Date: 2025-04-29

Coop UQAM COOP UQAM is one of the largest school-based cooperatives in Quebec. Located in the heart ...

LaBella Associates Rhysida

Discovery Date: 2025-04-28

LaBella Associates Founded in 1978, LaBella Associates is a full service Architecture, Engineering, ...

MDB Rhysida

Discovery Date: 2025-04-26

MDB MDB Srl was founded in 1977 by Mario Di Biase in Abruzzo, Italy....

Milicic Rhysida

Discovery Date: 2025-04-23

Milicic We are an Argentine construction and services company with 50 years of experience in large-s...

Acos Favorit Rhysida

Discovery Date: 2025-04-22

Acos Favorit Founded in 1996 by Rudolf Fritsch, Acos Favorit Distribuidora Ltda focuses on cutting a...

Oregon Department of Environmental Quality Rhysida

Discovery Date: 2025-04-15

Oregon Department of Environmental Quality They think their data hasn't been stolen. They're sorely ...

Dimension Composite Rhysida

Discovery Date: 2025-04-12

Dimension Composite Dimension Composite is an ISO 9001:2000 certified company, whose mission is to d...

Swiss Capitals Group Rhysida

Discovery Date: 2025-04-06

Swiss Capitals Group Swiss Capitals Group is the holding of a group of companies with more than 40 y...

Clarity Ventures Rhysida

Discovery Date: 2025-04-02

Clarity Ventures Clarity Ventures, Inc offers custom eCommerce and mobile web design solutions as we...

Forrest City School District Rhysida

Discovery Date: 2025-03-28

Forrest City School District Forrest City School District 7 is a school district headquartered in Fo...

Senior Support Services Rhysida

Discovery Date: 2025-03-27

Senior Support Services Senior Support Services (CPHC) first began serving the seniors of Brockvill...

Okeene Elementary School Rhysida

Discovery Date: 2025-03-25

Okeene Elementary School Okeene Elementary School is a public school located in Okeene, OK, which is...

Ted Hosmer Enterprises Rhysida

Discovery Date: 2025-03-18

Ted Hosmer Enterprises Ted Hosmer Enterprises, established in 1987, specializes in lawn care and sno...

Cothron's Security Professionals Rhysida

Discovery Date: 2025-03-14

Cothron's Security Professionals Founded by Mr. Olen Cothron in 1948, Cothron's is a leader in the s...

British virgin islands London Office Rhysida

Discovery Date: 2025-03-09

British virgin islands London Office Opened in 2002, the BVI London Office represents the interests ...

Best Collateral, Inc. Rhysida

Discovery Date: 2025-03-05

Best Collateral, Inc. Headquartered in San Rafael, California, Best Collateral opened its first stor...

Newton & Associates, Inc Rhysida

Discovery Date: 2025-03-01

Newton & Associates, Inc Newton & Associates Inc is a company that operates in the Accounting Servic...

Peter Glenn Ski Sport Rhysida

Discovery Date: 2025-02-22

Peter Glenn Ski Sport Peter Glenn Ski and Sport is a retailer of clothing and accessories for skiing...

Buanderie Centrale de Montreal Rhysida

Discovery Date: 2025-02-18

Buanderie Centrale de Montreal BCM is a non-profit organization that, since 1979 , has offered laund...

The Agency Rhysida

Discovery Date: 2025-02-14

The Agency Established in 1995, The Agency represents the most formidable list of writers, directors...

Leading Edge Specialized Dentistry Rhysida