Rhysida Ransomware Group: Victims, TTPs and Activity

Group overview

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin. After encryption, the ransomware appends the extension '.ryshida' to encrypted files.Source: https://github.com/crocodyli/ThreatActors-TTPs

Preferred targets

Construction · 1 Public Sector · 1 Education · 1 Manufacturing · 1

Most targeted countries

US · 2 DE · 1 GB · 1

Tactics & techniques (MITRE ATT&CK)

Initial Access

Abusing Elevation Control Mechanism: Bypass User Account Control Phishing

Execution

Command and Scripting Interpreter Shared Modules

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Process Injection Thread Execution Hijacking Registry Run Keys

Defense Evasion

Obfuscated Files or Information Masquerading Process Injection Thread Execution Hijacking Virtualization/Sandbox Evasion Hidden Artifacts NTFS File Attributes Reflective DLL Injection

Discovery

Application Window Discovery Process Discovery System Information Discovery File and Directory Discovery Virtualization/Sandbox Evasion Security Software Discovery

Collection

Data from Local System Automated Collection

Exfiltration

Exfiltration Over C2 Channel

rhysida

Group overview

Preferred targets

Most targeted countries

Tactics & techniques (MITRE ATT&CK)

Victim Claims Timeline

Group overview

Preferred targets

Most targeted countries

Tactics & techniques (MITRE ATT&CK)

Victim Claims Timeline

Other Active Groups