Loading threat actor…
Rhysida, also known as the Rhysida ransomware group or Rhysida ransomware gang, is a financially motivated cybercriminal operation first detected in May 2023. It conducts double-extortion attacks, stealing sensitive information and encrypting victim systems before demanding payment. The group operates a dedicated leak site to pressure victims through threatened or actual publication of stolen data. Its targets include government agencies, healthcare providers, educational institutions, manufacturers, legal and professional-services firms, technology providers, property-management businesses, and video-game developers. Rhysida operators gain initial access through phishing, compromised VPN and RDP accounts, and malicious downloads promoted through search-engine poisoning. Observed activity includes abusing VPN accounts without multifactor authentication, purchasing compromised remote-access accounts, and exploiting Zerologon (CVE-2020-1472). In one investigated intrusion, a trojanized PuTTY download established access and persistence. Operators subsequently used RDP for lateral movement, Advanced Port Scanner for network enumeration, and AzCopy to exfiltrate files to attacker-controlled Azure storage. AnyDesk has also appeared in Rhysida-associated ransomware activity. Before deploying ransomware, operators have attempted to stop security, database, backup, and virtualization services; terminate defensive processes; modify local accounts; enable remote administration; and weaken endpoint protections. Their scripts have also attempted to delete backups and volume shadow copies, disable recovery, clear event logs, and erase PowerShell history. These behaviors support ransomware deployment while obstructing detection, investigation, and restoration. Notable targets include United States local governments, Berlin's administration, Kuwait's Finance Ministry, and Insomniac Games. The group's operations have exposed confidential government documents, personal and medical information, financial records, and proprietary software-development material. Its country of origin and any state sponsorship are not established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
39 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
83 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rhysida claimed responsibility for the August breach of Anne Arundel County, Maryland, and demanded $2 million to prevent publication of an alleged 2.6 terabytes of stolen documents. County officials confirmed unauthorized access and file theft, but the content does not independently confirm Rhysida's attribution or claimed data volume. The group has also targeted government entities in Berlin, Kuwait, Seattle, Columbus, and Maryland.
Rhysida is identified as responsible for data theft and extortion targeting Berlin's public administration, particularly the departments responsible for transport and environment, and urban development, construction and housing. The group demanded 30 bitcoin, approximately €2 million, and published stolen data on the darknet after Berlin refused to pay. Exposed information included passwords, personnel records, disciplinary proceedings, financial documents and critical-infrastructure details. Authorities reported no further attacks on the examined network areas after August 13, 2026, and said the attacker had not established persistent infiltration. The article does not establish that ransomware encryption occurred.
The report attributes a ransomware attack against US professional-services firm Reed & Giordano PA to Rhysida. The reported breach involves 94,604 files totaling approximately 51.3 GB, including client trust-account banking details, wire-transfer information, tax forms containing Social Security numbers, identity documents, client money flows, and a signed conflict-of-interest letter.
Rhysida claims to have stolen 94,604 files totaling approximately 51.3 GB from Reed & Giordano PA, a US law firm listed on October 11, 2026. The claimed data includes client trust-account details, wire-transfer information, tax forms containing SSNs, identity documents, and confidential legal correspondence; no ransom amount or deadline is stated.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.